# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1611 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1612 --- ## [About the 7.x version of the search.max\_buckets parameter](https://discuss.elastic.co/t/about-the-7-x-version-of-the-search-max-buckets-parameter/260512)
**Author:** [@liwanjie](https://discuss.elastic.co/u/liwanjie)\ **Replies:** 2\ **Last updated:** [January 11, 2021, 7:04am UTC](https://discuss.elastic.co/t/about-the-7-x-version-of-the-search-max-buckets-parameter/260512 "2021-01-11T07:04:58Z")
I would like to ask if the check\_buckets\_step\_size parameter is added in 7.7.0. Has the max\_bucketsparameter been repealed in subsequent releases (including the latest 7.10.0)? If not repealed, are there any defaults? --- ## [Field.keyword empty in Discover](https://discuss.elastic.co/t/field-keyword-empty-in-discover/260534)
**Author:** [@HerveSavard](https://discuss.elastic.co/u/HerveSavard)\ **Replies:** 1\ **Last updated:** [January 11, 2021, 6:52am UTC](https://discuss.elastic.co/t/field-keyword-empty-in-discover/260534 "2021-01-11T06:52:56Z")
Hello All, In Discover, i see all my value do i need. sysvalval 2 When i add a filter like sysvalval.keyword the list of value is empty. I use Kibana version v7.10 Many thanks in advance --- ## [Logstash doesnt start after upgrade to 6.8.13 (from 6.2.3)](https://discuss.elastic.co/t/logstash-doesnt-start-after-upgrade-to-6-8-13-from-6-2-3/260599)
**Author:** [@cfu](https://discuss.elastic.co/u/cfu)\ **Replies:** 1\ **Last updated:** [January 11, 2021, 6:39am UTC](https://discuss.elastic.co/t/logstash-doesnt-start-after-upgrade-to-6-8-13-from-6-2-3/260599 "2021-01-11T06:39:26Z")
After upgrading logstash 6.3.2 to 6.8.13 it doesn´t start. Looking into the log file shows: \[2021-01-09T11:24:12,770\]\[DEBUG\]\[logstash.modules.scaffold\] Found module {:module\_name=\>"fb\_apache", :directory=\>"/products/el… --- ## [Elasticsearch index error](https://discuss.elastic.co/t/elasticsearch-index-error/260634)
**Author:** [@abu.sayeed](https://discuss.elastic.co/u/abu.sayeed)\ **Replies:** 4\ **Last updated:** [January 11, 2021, 6:06am UTC](https://discuss.elastic.co/t/elasticsearch-index-error/260634 "2021-01-11T06:06:30Z")
elasticsearch.yml network.host: localhost http.port: 9200 transport.host: localhost transport.tcp.port: 9300 discovery.seed\_hosts: localhost:9300 cluster.initial\_master\_nodes: ${HOSTNAME} action.auto\_create\_inde… --- ## [Logs are no longer sent to elasticsearch](https://discuss.elastic.co/t/logs-are-no-longer-sent-to-elasticsearch/260378)
**Author:** [@Falikou1](https://discuss.elastic.co/u/Falikou1)\ **Replies:** 3\ **Last updated:** [January 11, 2021, 4:46am UTC](https://discuss.elastic.co/t/logs-are-no-longer-sent-to-elasticsearch/260378 "2021-01-11T04:46:20Z")
I receive the logs in logstash, but the logs are no longer sent to elasticsearch. Can you help me? Below are the logs in logstash: \[root@scs90104vu logstash\]# tail -f /var/log/logstash/logstash-plain.log \[2021-01-06T… --- ## [Ingest pipe line csv parser with multiline message failing](https://discuss.elastic.co/t/ingest-pipe-line-csv-parser-with-multiline-message-failing/260666)
**Author:** [@Bo\_Koralage](https://discuss.elastic.co/u/Bo_Koralage)\ **Replies:** 0\ **Last updated:** [January 11, 2021, 4:18am UTC](https://discuss.elastic.co/t/ingest-pipe-line-csv-parser-with-multiline-message-failing/260666 "2021-01-11T04:18:00Z")
I am using a csv processor and \\t as the separator ingest pipeline to push logs from filebeat. This works great but fails when the message (logmessage) portion has a new line character. I added the following to the fileb… --- ## [Error when importing data from maraidb](https://discuss.elastic.co/t/error-when-importing-data-from-maraidb/260665)
**Author:** [@Tails](https://discuss.elastic.co/u/Tails)\ **Replies:** 0\ **Last updated:** [January 11, 2021, 4:07am UTC](https://discuss.elastic.co/t/error-when-importing-data-from-maraidb/260665 "2021-01-11T04:07:08Z")
I installed the ik plugin to elasticsearch and I have the following errors when importing from mariadb. \[2021-01-11T11:49:38,392\]\[WARN \]\[logstash.outputs.elasticsearch\]\[main\]\[6611aaa54ebe00de3255376c35e28d779a2b6f627197… --- ## [Vsphere metric in windows trying to connect on localhost address](https://discuss.elastic.co/t/vsphere-metric-in-windows-trying-to-connect-on-localhost-address/260277)
**Author:** [@rohan0018](https://discuss.elastic.co/u/rohan0018)\ **Replies:** 2\ **Last updated:** [January 11, 2021, 3:34am UTC](https://discuss.elastic.co/t/vsphere-metric-in-windows-trying-to-connect-on-localhost-address/260277 "2021-01-11T03:34:49Z")
Hi!!! I have installed and enabled vsphere metricbeat module on my vcenter server. I have configured vsphere.yml as below. '''''metricbeat.modules: module: vsphere enabled: true metricsets: \["datastore", "host", … --- ## [How to find which node, with an old version of metricbeat, is the data coming from?](https://discuss.elastic.co/t/how-to-find-which-node-with-an-old-version-of-metricbeat-is-the-data-coming-from/260389)
**Author:** [@vee](https://discuss.elastic.co/u/vee)\ **Replies:** 8\ **Last updated:** [January 11, 2021, 1:51am UTC](https://discuss.elastic.co/t/how-to-find-which-node-with-an-old-version-of-metricbeat-is-the-data-coming-from/260389 "2021-01-11T01:51:53Z")
We've upgraded to elastic v7.5 a few months ago, and upgraded most of the known servers metricbeat to the same version. However, looks like there might be a few servers which still have v6.6 metricbeat running and so we … --- ## [Set \_type in logstash](https://discuss.elastic.co/t/set-type-in-logstash/260643)
**Author:** [@navin1093](https://discuss.elastic.co/u/navin1093)\ **Replies:** 2\ **Last updated:** [January 11, 2021, 1:21am UTC](https://discuss.elastic.co/t/set-type-in-logstash/260643 "2021-01-11T01:21:57Z")
Hi experts. As per my research index (Elastic Search) -\> database (RDMS) type (Elastic Search) -\> table (RDMS) Can i know how i can set the type? input { beats { port =\> 5044 ... type =\> "%{\[fields\]\[na… --- ## [Problem with logs ilm policy elk7.9.1](https://discuss.elastic.co/t/problem-with-logs-ilm-policy-elk7-9-1/260455)
**Author:** [@Rollup\_eval](https://discuss.elastic.co/u/Rollup_eval)\ **Replies:** 2\ **Last updated:** [January 11, 2021, 12:24am UTC](https://discuss.elastic.co/t/problem-with-logs-ilm-policy-elk7-9-1/260455 "2021-01-11T00:24:16Z")
Hi, I have upgrade my stack from elk6.7.1 to elk7.9.1. In my stack index name are : logs-kelogs-pltf-YYYY.MM.dd.hh These indices are not managed by rollover and ilm policies. Logtash creates each hour a new index log… --- ## [Object field vs Individual field](https://discuss.elastic.co/t/object-field-vs-individual-field/260527)
**Author:** [@naghaveer\_r](https://discuss.elastic.co/u/naghaveer_r)\ **Replies:** 1\ **Last updated:** [January 11, 2021, 12:22am UTC](https://discuss.elastic.co/t/object-field-vs-individual-field/260527 "2021-01-11T00:22:19Z")
I have two fields "support.agent" and "support.resolution". If I can map these field as an Object type, I'll be able to fetch them together and also provides more readability "support": { "properties": { … --- ## [Custom data format not working in elasticsearch](https://discuss.elastic.co/t/custom-data-format-not-working-in-elasticsearch/260530)
**Author:** [@gavin-orange](https://discuss.elastic.co/u/gavin-orange)\ **Replies:** 1\ **Last updated:** [January 11, 2021, 12:20am UTC](https://discuss.elastic.co/t/custom-data-format-not-working-in-elasticsearch/260530 "2021-01-11T00:20:57Z")
I am using the filebeat to transfer nginx access log to elasticsearch with json format . access.log { "@timestamp": "05/Jan/2021:13:38:28 +0800", "pid": "52336", "connection": "217062444", "connection\_requests": "18", … --- ## [Running journalbeat as non-privileged user](https://discuss.elastic.co/t/running-journalbeat-as-non-privileged-user/260552)
**Author:** [@jmcclelland](https://discuss.elastic.co/u/jmcclelland)\ **Replies:** 0\ **Last updated:** [January 8, 2021, 2:04pm UTC](https://discuss.elastic.co/t/running-journalbeat-as-non-privileged-user/260552 "2021-01-08T14:04:56Z")
Hi all - I am sharing this for anyone else interested in running journalbeat as a non-root user. I'm grateful for the attention to security of the elasticsearch team but I think the solar winds compromise is making us al… --- ## [ES 7.9.1 - No Lens option](https://discuss.elastic.co/t/es-7-9-1-no-lens-option/260538)
**Author:** [@iam\_rob](https://discuss.elastic.co/u/iam_rob)\ **Replies:** 3\ **Last updated:** [January 11, 2021, 12:18am UTC](https://discuss.elastic.co/t/es-7-9-1-no-lens-option/260538 "2021-01-11T00:18:58Z")
Good morning, We're currently investigating Kibana as a solution. Locally I am running 7.9.2 and when creating a new Visualizations I can select Lens. On our AWS version (7.9.1) we don't appear to have this option. How… --- ## [Elastic 5 \> 7: Decrease Storage Usage?](https://discuss.elastic.co/t/elastic-5-7-decrease-storage-usage/260594)
**Author:** [@myspacebarisbroken](https://discuss.elastic.co/u/myspacebarisbroken)\ **Replies:** 1\ **Last updated:** [January 11, 2021, 12:15am UTC](https://discuss.elastic.co/t/elastic-5-7-decrease-storage-usage/260594 "2021-01-11T00:15:54Z")
Hi! I'm upgrading my ES cluster from V 5 to V7, I've noticed that space usage has significantly been reduced, is that normal? my V5 cluster: 10B Documents, ~2.2 TB V7 Cluster: 10B Documents, ~1.5 TB (Same exact docum… --- ## [java.lang.OutOfMemoryError: Java heap space in Logstash](https://discuss.elastic.co/t/java-lang-outofmemoryerror-java-heap-space-in-logstash/260596)
**Author:** [@rknd](https://discuss.elastic.co/u/rknd)\ **Replies:** 1\ **Last updated:** [January 11, 2021, 12:13am UTC](https://discuss.elastic.co/t/java-lang-outofmemoryerror-java-heap-space-in-logstash/260596 "2021-01-11T00:13:43Z")
I have too many configuration files. I run these files together via pipelines.yml. I use these types of settings likewise below; - pipeline.id: pipeline1 path.config: "path\_to\_pipeline1" - pipeline.id: pipeline2 pat… --- ## [How to configure rolling OR delete after X time of data dir , to prevent "out of space" error](https://discuss.elastic.co/t/how-to-configure-rolling-or-delete-after-x-time-of-data-dir-to-prevent-out-of-space-error/260639)
**Author:** [@umen](https://discuss.elastic.co/u/umen)\ **Replies:** 1\ **Last updated:** [January 11, 2021, 12:10am UTC](https://discuss.elastic.co/t/how-to-configure-rolling-or-delete-after-x-time-of-data-dir-to-prevent-out-of-space-error/260639 "2021-01-11T00:10:10Z")
i configured the cluster to claim 5g for the data dir volumeClaimTemplates: - metadata: name: elasticsearch-data spec: accessModes: - ReadWriteOnce resources: requ… --- ## [ES Cloud instance Monotoring and Alerting](https://discuss.elastic.co/t/es-cloud-instance-monotoring-and-alerting/260423)
**Author:** [@webservices](https://discuss.elastic.co/u/webservices)\ **Replies:** 3\ **Last updated:** [January 11, 2021, 12:07am UTC](https://discuss.elastic.co/t/es-cloud-instance-monotoring-and-alerting/260423 "2021-01-11T00:07:02Z")
Hi All, We have a subscription for Elastic Cloud instance and my goal is to monitor the instance for CPU and Memory. I have enabled logs and metrics in my deployment but when I goto metrics then I do not see any data. A… --- ## [Role Granted Documents Query example](https://discuss.elastic.co/t/role-granted-documents-query-example/260652)
**Author:** [@rdesanno](https://discuss.elastic.co/u/rdesanno)\ **Replies:** 2\ **Last updated:** [January 11, 2021, 12:06am UTC](https://discuss.elastic.co/t/role-granted-documents-query-example/260652 "2021-01-11T00:06:14Z")
Hey all! What I am trying to accomplish is to grant access to my Kibana indexes for a certain user BUT limit them to only data being ingested where agent.hostame matches a certain host. I thought I could easily accompl… --- ## [Filebeat fields value unable to use it in logstash configuration file](https://discuss.elastic.co/t/filebeat-fields-value-unable-to-use-it-in-logstash-configuration-file/260614)
**Author:** [@navin1093](https://discuss.elastic.co/u/navin1093)\ **Replies:** 8\ **Last updated:** [January 10, 2021, 11:20pm UTC](https://discuss.elastic.co/t/filebeat-fields-value-unable-to-use-it-in-logstash-configuration-file/260614 "2021-01-10T23:20:24Z")
I have set custom name in filebeat input section. However, in logstash configuration file it was unable to be use Filebeat config file - type: log enabled: true paths: ... fields: - name\_of\_index: group-1… --- ## [Capturing clear text beats traffic with wireshark](https://discuss.elastic.co/t/capturing-clear-text-beats-traffic-with-wireshark/260590)
**Author:** [@qbui](https://discuss.elastic.co/u/qbui)\ **Replies:** 1\ **Last updated:** [January 10, 2021, 10:00pm UTC](https://discuss.elastic.co/t/capturing-clear-text-beats-traffic-with-wireshark/260590 "2021-01-10T22:00:23Z")
Hello, Has anyone tried to capture and analyze the "clear text" beats traffic (FileBeat, Winlogbeats, etc.) as it is being sent to Logstash or Elasticsearch? In its default configuration, the traffic is being sent unenc… --- ## [Scripted\_upsert not working when logtash looses connection to ES and reconnects](https://discuss.elastic.co/t/scripted-upsert-not-working-when-logtash-looses-connection-to-es-and-reconnects/260651)
**Author:** [@Pachidermus](https://discuss.elastic.co/u/Pachidermus)\ **Replies:** 1\ **Last updated:** [January 10, 2021, 6:40pm UTC](https://discuss.elastic.co/t/scripted-upsert-not-working-when-logtash-looses-connection-to-es-and-reconnects/260651 "2021-01-10T18:40:18Z")
I am experiencing the exact same problem as here: The setup is very basic. We are using the ES output plugin with a basic logic: output { if \[@metadata\]\[scripted\_upsert\] == "true" { elasticsearch { ... … --- ## [Multi-Tenancy and Indexes / Aliases / Routing](https://discuss.elastic.co/t/multi-tenancy-and-indexes-aliases-routing/260655)
**Author:** [@nickdb93](https://discuss.elastic.co/u/nickdb93)\ **Replies:** 0\ **Last updated:** [January 10, 2021, 6:16pm UTC](https://discuss.elastic.co/t/multi-tenancy-and-indexes-aliases-routing/260655 "2021-01-10T18:16:31Z")
I know that how one deals with multi-tenancy is really based on use-case, but I just cannot seem to figure out the best approach to take, even after reading some examples. My use case is as such. Organizations are te… --- ## [How could I use in ingest pipeline the Logstash translate filter?](https://discuss.elastic.co/t/how-could-i-use-in-ingest-pipeline-the-logstash-translate-filter/259697)
**Author:** [@marcosvrrs](https://discuss.elastic.co/u/marcosvrrs)\ **Replies:** 4\ **Last updated:** [January 10, 2021, 2:36pm UTC](https://discuss.elastic.co/t/how-could-i-use-in-ingest-pipeline-the-logstash-translate-filter/259697 "2021-01-10T14:36:32Z")
I have a field with some error codes mapped as keyword values that I make some plots. It's not friendly to some people to look at these codes, so I want to change these error codes to a description that I will map as key… --- ## [Kibana TSVB table visualization - group by multiple fields](https://discuss.elastic.co/t/kibana-tsvb-table-visualization-group-by-multiple-fields/260631)
**Author:** [@igorid70](https://discuss.elastic.co/u/igorid70)\ **Replies:** 1\ **Last updated:** [January 10, 2021, 1:21pm UTC](https://discuss.elastic.co/t/kibana-tsvb-table-visualization-group-by-multiple-fields/260631 "2021-01-10T13:21:42Z")
Hi I am using Elastic stack 7.9.1 and trying to build a visualization in Kibana with time series visual builder. In our environment we monitor multiple hosts and one of the visualizations on a dashboard should present … --- ## [Weird memory growth (ES 7.9)](https://discuss.elastic.co/t/weird-memory-growth-es-7-9/260479)
**Author:** [@zanettea](https://discuss.elastic.co/u/zanettea)\ **Replies:** 2\ **Last updated:** [January 10, 2021, 12:12pm UTC](https://discuss.elastic.co/t/weird-memory-growth-es-7-9/260479 "2021-01-10T12:12:53Z")
Hello, we are experiencing anomalous memory usage in a memory constrained cluster of 3 nodes running ES 7.9. We set 2GB heap size with 4 GB overall available RAM. After some days of normal operation where there are mainl… --- ## [Mapping data, tokenizer](https://discuss.elastic.co/t/mapping-data-tokenizer/260629)
**Author:** [@Jaroslav\_Zeman](https://discuss.elastic.co/u/Jaroslav_Zeman)\ **Replies:** 2\ **Last updated:** [January 10, 2021, 11:06am UTC](https://discuss.elastic.co/t/mapping-data-tokenizer/260629 "2021-01-10T11:06:26Z")
Hi I am a beginner in using elasticsearch, and I have a few questions on how best to store the data in elasticsearch with respect to the maximum search speed. In the relational database, I have the following three enti… --- ## [Increasing ‘index.mapping.nested\_objects.limit’ setting](https://discuss.elastic.co/t/increasing-index-mapping-nested-objects-limit-setting/260633)
**Author:** [@kliakos](https://discuss.elastic.co/u/kliakos)\ **Replies:** 0\ **Last updated:** [January 10, 2021, 9:11am UTC](https://discuss.elastic.co/t/increasing-index-mapping-nested-objects-limit-setting/260633 "2021-01-10T09:11:46Z")
I have the same problem as this https://discuss.elastic.co/t/increasing-index-mapping-nested-objects-limit-settings-value-has-no-effect/228242. The new setting, although applied to the index, doesn't seem to have any ef… --- ## [Logstash high CPU on JDBC plugin](https://discuss.elastic.co/t/logstash-high-cpu-on-jdbc-plugin/260610)
**Author:** [@Kevin\_Juliano](https://discuss.elastic.co/u/Kevin_Juliano)\ **Replies:** 1\ **Last updated:** [January 10, 2021, 2:08am UTC](https://discuss.elastic.co/t/logstash-high-cpu-on-jdbc-plugin/260610 "2021-01-10T02:08:40Z")
Hi! I am running Logstash with JDBC plugin postgreSQL, as I check the performance of our server, because I are having some timeout issues, I found out that Logstash when running is having more than 100% CPU usage. Wh… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1610) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1612)