# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1610 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1611 --- ## [Filebeat Azure module](https://discuss.elastic.co/t/filebeat-azure-module/256771)
**Author:** [@Marco0101](https://discuss.elastic.co/u/Marco0101)\ **Replies:** 1\ **Last updated:** [January 11, 2021, 1:05pm UTC](https://discuss.elastic.co/t/filebeat-azure-module/256771 "2021-01-11T13:05:41Z")
Hi, i would like to know if the activitylogs - auditlogs can only be used for Azure AD audit events or that it is also possible to use it for keyvault audit logging also. Because we built an eventhub and pass the keyvaul… --- ## [Painless script error](https://discuss.elastic.co/t/painless-script-error/260709)
**Author:** [@Andreas\_Amundsen](https://discuss.elastic.co/u/Andreas_Amundsen)\ **Replies:** 2\ **Last updated:** [January 11, 2021, 12:45pm UTC](https://discuss.elastic.co/t/painless-script-error/260709 "2021-01-11T12:45:54Z")
Hi, I'm trying to create a scripted field with the simple painless-code bellow. Math.round((doc\['CRC\_OK'\].value / doc\['NR\_UWs'\].value)\*100)/100.0 Everything seems to be working when I preview the code: When I open the… --- ## [How to search string containing hypen?](https://discuss.elastic.co/t/how-to-search-string-containing-hypen/260713)
**Author:** [@Sahil\_Kumar](https://discuss.elastic.co/u/Sahil_Kumar)\ **Replies:** 0\ **Last updated:** [January 11, 2021, 12:08pm UTC](https://discuss.elastic.co/t/how-to-search-string-containing-hypen/260713 "2021-01-11T12:08:42Z")
Hi, I want to index text that contains hyphens, for example MiddleEaton-Byers but I am unable to because with the regular expression \*{seachparams}\* the results are not coming? Below is the query string: "query": { "q… --- ## [Curl: (52) Empty reply from server When trying to restart cluster ( given user/password )](https://discuss.elastic.co/t/curl-52-empty-reply-from-server-when-trying-to-restart-cluster-given-user-password/260717)
**Author:** [@umen](https://discuss.elastic.co/u/umen)\ **Replies:** 0\ **Last updated:** [January 11, 2021, 12:19pm UTC](https://discuss.elastic.co/t/curl-52-empty-reply-from-server-when-trying-to-restart-cluster-given-user-password/260717 "2021-01-11T12:19:22Z")
i try to restart the cluster with the put command as stated in the docs: curl -u "elastic:xxxxxxxxx" -k -X PUT "localhost:9200/\_cluster/settings?pretty" -H 'Content-Type: application/json' -d' { "persistent": { … --- ## [How to add lookup fields to kibana visualization?](https://discuss.elastic.co/t/how-to-add-lookup-fields-to-kibana-visualization/260662)
**Author:** [@Rithwik\_Pat](https://discuss.elastic.co/u/Rithwik_Pat)\ **Replies:** 3\ **Last updated:** [January 11, 2021, 12:17pm UTC](https://discuss.elastic.co/t/how-to-add-lookup-fields-to-kibana-visualization/260662 "2021-01-11T12:17:02Z")
Say I am using lens to find all product ids in an index with a certain criteria and display in a table. Then I want to lookup the product id in another index to get the product name. So finally the result is a table that… --- ## [About creation of kibana\_N+1 index](https://discuss.elastic.co/t/about-creation-of-kibana-n-1-index/260414)
**Author:** [@pratiksha](https://discuss.elastic.co/u/pratiksha)\ **Replies:** 4\ **Last updated:** [January 11, 2021, 12:12pm UTC](https://discuss.elastic.co/t/about-creation-of-kibana-n-1-index/260414 "2021-01-11T12:12:26Z")
Hi, When does kibana\_N+1 index gets created? Can kibana\_N+1 gets created if there are more than 1 replicas of kibana running. Is it possible that kibana index migration process get initiated between same elk version u… --- ## [Building plugin in Kibana 7.8.0](https://discuss.elastic.co/t/building-plugin-in-kibana-7-8-0/259981)
**Author:** [@ssimmons](https://discuss.elastic.co/u/ssimmons)\ **Replies:** 11\ **Last updated:** [January 11, 2021, 12:08pm UTC](https://discuss.elastic.co/t/building-plugin-in-kibana-7-8-0/259981 "2021-01-11T12:08:46Z")
I've built my own plugin in Kibana 7.8.0. I'm now trying to do a yarn build command to build the plugin so I can install it on our dev server. I created the plugin using the node scripts/generate-plugin command. However,… --- ## [Logstash crashing, user error with pipeline and SSL certs configuration](https://discuss.elastic.co/t/logstash-crashing-user-error-with-pipeline-and-ssl-certs-configuration/260612)
**Author:** [@Eden\_Corbin](https://discuss.elastic.co/u/Eden_Corbin)\ **Replies:** 2\ **Last updated:** [January 11, 2021, 12:03pm UTC](https://discuss.elastic.co/t/logstash-crashing-user-error-with-pipeline-and-ssl-certs-configuration/260612 "2021-01-11T12:03:55Z")
I'm struggling a bit getting certs in place for just logstash and filebeat. My goal is to secure log trasnport between VPS instances and my logstash server. Although I'm testing with everything on the same server at the … --- ## [Elastic clound 100% memory on instances, snapshot is stuck in IN\_PROGRESS](https://discuss.elastic.co/t/elastic-clound-100-memory-on-instances-snapshot-is-stuck-in-in-progress/260439)
**Author:** [@birdy1980](https://discuss.elastic.co/u/birdy1980)\ **Replies:** 4\ **Last updated:** [January 11, 2021, 12:00pm UTC](https://discuss.elastic.co/t/elastic-clound-100-memory-on-instances-snapshot-is-stuck-in-in-progress/260439 "2021-01-11T12:00:27Z")
Hello, On one of our cloud deployments we have a bit of a problem. The memory usage grew to 100%. It is a high availability cluster in 2 zones, with a third instance as tiebreaker. We want to upgrade the instance to ha… --- ## [No results displayed because all values equal 0](https://discuss.elastic.co/t/no-results-displayed-because-all-values-equal-0/260679)
**Author:** [@lephuhai270](https://discuss.elastic.co/u/lephuhai270)\ **Replies:** 1\ **Last updated:** [January 11, 2021, 11:23am UTC](https://discuss.elastic.co/t/no-results-displayed-because-all-values-equal-0/260679 "2021-01-11T11:23:27Z")
I have installed Elastiflow 4.0.0 via https://github.com/robcowart/elastiflow but I got messages "No results displayed because all values equal 0" in all tabs of Elastiflow as attached file. So how could I fix this issue… --- ## [Suricata module with remote syslog input](https://discuss.elastic.co/t/suricata-module-with-remote-syslog-input/260707)
**Author:** [@kostiik](https://discuss.elastic.co/u/kostiik)\ **Replies:** 0\ **Last updated:** [January 11, 2021, 11:16am UTC](https://discuss.elastic.co/t/suricata-module-with-remote-syslog-input/260707 "2021-01-11T11:16:58Z")
Hello, I am unable to configure suricata.yml in filebeat/modules.d to receive suricata logs remotely from syslog instead a local log file. This post: https://discuss.elastic.co/t/using-the-filebeat-suricata-module-for-… --- ## [No space left on device with large sql imports despite plenty available](https://discuss.elastic.co/t/no-space-left-on-device-with-large-sql-imports-despite-plenty-available/260706)
**Author:** [@Baygon](https://discuss.elastic.co/u/Baygon)\ **Replies:** 0\ **Last updated:** [January 11, 2021, 10:46am UTC](https://discuss.elastic.co/t/no-space-left-on-device-with-large-sql-imports-despite-plenty-available/260706 "2021-01-11T10:46:43Z")
Hi, I created a brand new instance with a 50Gb SSD disk. 2 vCPU and 12Gb RAM. I'm using logstash to index one large table from a mysql db on another instance. df -h returns 32Gb disk available: root@el1:~# df -h Fil… --- ## [Disable x-pack on Auditbeat and Metricbeat clients 7.9 (AWS Elasticsearch service) using OSS version](https://discuss.elastic.co/t/disable-x-pack-on-auditbeat-and-metricbeat-clients-7-9-aws-elasticsearch-service-using-oss-version/258924)
**Author:** [@francisca.munhoz](https://discuss.elastic.co/u/francisca.munhoz)\ **Replies:** 5\ **Last updated:** [January 11, 2021, 11:11am UTC](https://discuss.elastic.co/t/disable-x-pack-on-auditbeat-and-metricbeat-clients-7-9-aws-elasticsearch-service-using-oss-version/258924 "2021-01-11T11:11:10Z")
Hi all, I'm using AWS Elasticsearch service (7.9) and I have installed metricbeat and auditbeat clients (oss) 7.9.1 on a linux node: Beats client source: However somehow x-pack check is enabled, so I'm getting … --- ## [Elasticsearch returns different values from DSL and SQL query](https://discuss.elastic.co/t/elasticsearch-returns-different-values-from-dsl-and-sql-query/259984)
**Author:** [@pkshara](https://discuss.elastic.co/u/pkshara)\ **Replies:** 9\ **Last updated:** [January 11, 2021, 10:53am UTC](https://discuss.elastic.co/t/elasticsearch-returns-different-values-from-dsl-and-sql-query/259984 "2021-01-11T10:53:18Z")
I am trying to query index using dsl and sql method, while comparing the results i found that the values are different.Below are the query and required details. DSL query and result SQL query and result Result f… --- ## [Output only s3 file create events to elastic search and not the contents of the files](https://discuss.elastic.co/t/output-only-s3-file-create-events-to-elastic-search-and-not-the-contents-of-the-files/260697)
**Author:** [@suhas\_1993](https://discuss.elastic.co/u/suhas_1993)\ **Replies:** 1\ **Last updated:** [January 11, 2021, 10:48am UTC](https://discuss.elastic.co/t/output-only-s3-file-create-events-to-elastic-search-and-not-the-contents-of-the-files/260697 "2021-01-11T10:48:02Z")
Hello team, Is there a config that enables Logstash s3 input plugin to output only s3 filenames under the bucket where Logstash config is polling on? The current below config is outputting file contents with message fi… --- ## [Heartbeat in dotnet core 3.1 services](https://discuss.elastic.co/t/heartbeat-in-dotnet-core-3-1-services/260274)
**Author:** [@Bilal\_Malik](https://discuss.elastic.co/u/Bilal_Malik)\ **Replies:** 1\ **Last updated:** [January 11, 2021, 10:43am UTC](https://discuss.elastic.co/t/heartbeat-in-dotnet-core-3-1-services/260274 "2021-01-11T10:43:12Z")
i have configured logging in Elasticsearch, it is working perfectly. Now I am looking for statuses of my microservices that are running or which one is down. How can i figure out using Elasticsearch? Every microservices … --- ## [Elasticearch cannot start](https://discuss.elastic.co/t/elasticearch-cannot-start/260701)
**Author:** [@Leonadius](https://discuss.elastic.co/u/Leonadius)\ **Replies:** 0\ **Last updated:** [January 11, 2021, 10:39am UTC](https://discuss.elastic.co/t/elasticearch-cannot-start/260701 "2021-01-11T10:39:27Z")
Hi, I have a problem where i cannot start the elasticsearch. This is what i get from the logs. \[2021-01-11T15:59:36,658\]\[ERROR\]\[o.e.b.ElasticsearchUncaughtExceptionHandler\] \[vm-elastic-mlearning\] fatal error in thread … --- ## [Endpoint Agent two host showing in logs-\* per host](https://discuss.elastic.co/t/endpoint-agent-two-host-showing-in-logs-per-host/260700)
**Author:** [@The1WhoPrtNocks](https://discuss.elastic.co/u/The1WhoPrtNocks)\ **Replies:** 0\ **Last updated:** [January 11, 2021, 10:36am UTC](https://discuss.elastic.co/t/endpoint-agent-two-host-showing-in-logs-per-host/260700 "2021-01-11T10:36:01Z")
Hi, I have recently been rolling out the Endpoint agent to some host for testing. Within the fleet agents tab, there is a single entry for each host in the format "hostname". However within the logs-\* index there are … --- ## [Regex vs range filter](https://discuss.elastic.co/t/regex-vs-range-filter/260658)
**Author:** [@aniaks](https://discuss.elastic.co/u/aniaks)\ **Replies:** 2\ **Last updated:** [January 11, 2021, 10:21am UTC](https://discuss.elastic.co/t/regex-vs-range-filter/260658 "2021-01-11T10:21:01Z")
Which filter is performance effective on a number field regex or range filter ? Also on a text field ... Using regex filter is performance effective ? --- ## [How to hide error message for graphs](https://discuss.elastic.co/t/how-to-hide-error-message-for-graphs/259554)
**Author:** [@Pranusha119](https://discuss.elastic.co/u/Pranusha119)\ **Replies:** 1\ **Last updated:** [January 11, 2021, 10:08am UTC](https://discuss.elastic.co/t/how-to-hide-error-message-for-graphs/259554 "2021-01-11T10:08:14Z")
{ "$schema": "https://vega.github.io/schema/vega-lite/v4.json", "description": "A simple bar chart with embedded data.", "data": { "values": \[ {"a": "A", "b": 28}, {"a": "B", "b": 55}, {"a": "C", "b": 43}… --- ## [Elasticsearch string query char to char](https://discuss.elastic.co/t/elasticsearch-string-query-char-to-char/258818)
**Author:** [@adrian-arapiles](https://discuss.elastic.co/u/adrian-arapiles)\ **Replies:** 2\ **Last updated:** [January 11, 2021, 9:29am UTC](https://discuss.elastic.co/t/elasticsearch-string-query-char-to-char/258818 "2021-01-11T09:29:39Z")
Hi, I need an index with phash indexed (64 length) and I have to query comparing char to char, for example: "d1b269d06ec8158d62333679ab6693e6bccd43761692e6c26527dcddd84c8196" "81b069d20e4154ed7b8371b3aa4596619c6d1ee45… --- ## [Logstash keystore Error](https://discuss.elastic.co/t/logstash-keystore-error/260689)
**Author:** [@baddack](https://discuss.elastic.co/u/baddack)\ **Replies:** 0\ **Last updated:** [January 11, 2021, 9:26am UTC](https://discuss.elastic.co/t/logstash-keystore-error/260689 "2021-01-11T09:26:26Z")
Hello everyone, Can someone help me to solve this error please? adminsys@logstash:/etc/logstash # /usr/share/logstash/bin/logstash --path.settings /etc/logstash -t Thread.exclusive is deprecated, use Thread::Mutex Send… --- ## [Elasticsearch data transfer and queries are very slow](https://discuss.elastic.co/t/elasticsearch-data-transfer-and-queries-are-very-slow/260420)
**Author:** [@RusseL](https://discuss.elastic.co/u/RusseL)\ **Replies:** 4\ **Last updated:** [January 11, 2021, 9:19am UTC](https://discuss.elastic.co/t/elasticsearch-data-transfer-and-queries-are-very-slow/260420 "2021-01-11T09:19:56Z")
Elasticsearch, queries and data transfer are very slow and I am getting timeout errors. I found this information in the log files of the data nodes. Elasticsearch and Kibana version 7.4.2 I have 13 nodes (3 master ,10 … --- ## [SQL data to Elasticsearch using logstash via Mysql connector JDBC plugin](https://discuss.elastic.co/t/sql-data-to-elasticsearch-using-logstash-via-mysql-connector-jdbc-plugin/260686)
**Author:** [@panfan](https://discuss.elastic.co/u/panfan)\ **Replies:** 0\ **Last updated:** [January 11, 2021, 8:46am UTC](https://discuss.elastic.co/t/sql-data-to-elasticsearch-using-logstash-via-mysql-connector-jdbc-plugin/260686 "2021-01-11T08:46:19Z")
Hello, I am having trouble giving input to the elasticearch from data of MySQL via logstash. The following is my simple config file: input { jdbc { clean\_run =\> true jdbc\_driver\_library =\> "mysql-connector-java-5.1… --- ## [Filebeat not collection logs of elastic pods](https://discuss.elastic.co/t/filebeat-not-collection-logs-of-elastic-pods/259719)
**Author:** [@raulgs](https://discuss.elastic.co/u/raulgs)\ **Replies:** 9\ **Last updated:** [January 11, 2021, 7:47am UTC](https://discuss.elastic.co/t/filebeat-not-collection-logs-of-elastic-pods/259719 "2021-01-11T07:47:12Z")
I am not sure since when this is happening, but my filebeat has stopped collecting the logs of elastic pods that I have deployed using eck. In total I do have these 3 pods: elastic-es-masterdata-100-0 elastic-es-master… --- ## [Unassigned shards: NODE\_LEFT (Cloud)](https://discuss.elastic.co/t/unassigned-shards-node-left-cloud/260444)
**Author:** [@bogdan\_copocean](https://discuss.elastic.co/u/bogdan_copocean)\ **Replies:** 3\ **Last updated:** [January 11, 2021, 7:47am UTC](https://discuss.elastic.co/t/unassigned-shards-node-left-cloud/260444 "2021-01-11T07:47:10Z")
Hello guys, I encountered a few problems with my Elasticsearch cluster (on cloud) and exactly, i have around 25 unassigned shards with the reason NODE\_LEFT and one with REPLICA\_ADDED (after I tried to add a replica). I… --- ## [Troubles with heap, gc. Node fault](https://discuss.elastic.co/t/troubles-with-heap-gc-node-fault/259616)
**Author:** [@ThreatInter](https://discuss.elastic.co/u/ThreatInter)\ **Replies:** 16\ **Last updated:** [January 11, 2021, 7:30am UTC](https://discuss.elastic.co/t/troubles-with-heap-gc-node-fault/259616 "2021-01-11T07:30:00Z")
Hello again, my new topic about our problem. We have ES cluster with 3 nodes. Each 128 Gb RAM, 31 GB Heap, there our jvm.options: -Xms31g -Xmx31g ## GC configuration #-XX:+UseConcMarkSweepGC #-XX:CMSInitiatingOccupanc… --- ## [How does document size affect ElasticSearch performance?](https://discuss.elastic.co/t/how-does-document-size-affect-elasticsearch-performance/260648)
**Author:** [@sanchita.jha](https://discuss.elastic.co/u/sanchita.jha)\ **Replies:** 4\ **Last updated:** [January 11, 2021, 7:26am UTC](https://discuss.elastic.co/t/how-does-document-size-affect-elasticsearch-performance/260648 "2021-01-11T07:26:24Z")
Planning to increase document size in elastic, from 4KB to ~100KB each. What is the performance impact with document size increase? The new fields will have to be additonality used to calculate/modify final scores of do… --- ## [java.lang.OutOfMemoryError: Java heap space](https://discuss.elastic.co/t/java-lang-outofmemoryerror-java-heap-space/259773)
**Author:** [@rknd](https://discuss.elastic.co/u/rknd)\ **Replies:** 3\ **Last updated:** [January 9, 2021, 8:18am UTC](https://discuss.elastic.co/t/java-lang-outofmemoryerror-java-heap-space/259773 "2021-01-09T08:18:36Z")
Hello everyone I've got this error. java.lang.OutOfMemoryError: Java heap space When I run my pipeline. I set jvm option the below. But still getting this jvm error. -Xms8M -Xmx8M How can i solve ? Can someone expl… --- ## [About the 7.x version of the search.max\_buckets parameter](https://discuss.elastic.co/t/about-the-7-x-version-of-the-search-max-buckets-parameter/260512)
**Author:** [@liwanjie](https://discuss.elastic.co/u/liwanjie)\ **Replies:** 2\ **Last updated:** [January 11, 2021, 7:04am UTC](https://discuss.elastic.co/t/about-the-7-x-version-of-the-search-max-buckets-parameter/260512 "2021-01-11T07:04:58Z")
I would like to ask if the check\_buckets\_step\_size parameter is added in 7.7.0. Has the max\_bucketsparameter been repealed in subsequent releases (including the latest 7.10.0)? If not repealed, are there any defaults? [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1609) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1611)