# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1617 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1618 --- ## [So many variables in logstash filters](https://discuss.elastic.co/t/so-many-variables-in-logstash-filters/260325)
**Author:** [@nyquillus](https://discuss.elastic.co/u/nyquillus)\ **Replies:** 0\ **Last updated:** [January 6, 2021, 10:35am UTC](https://discuss.elastic.co/t/so-many-variables-in-logstash-filters/260325 "2021-01-06T10:35:57Z")
Hi, I'm planning to convert to a new logstash config to remodel my indexing and i added an if/if else/else filter to logstash. Right now the cluster has around 85 active indices which roll daily. Almost half of it will b… --- ## [Enrichment file for threat feeds in logstash](https://discuss.elastic.co/t/enrichment-file-for-threat-feeds-in-logstash/260258)
**Author:** [@Falikou1](https://discuss.elastic.co/u/Falikou1)\ **Replies:** 2\ **Last updated:** [January 6, 2021, 10:07am UTC](https://discuss.elastic.co/t/enrichment-file-for-threat-feeds-in-logstash/260258 "2021-01-06T10:07:36Z")
Hello, I'm sending threat feeds to elasticsearch from a linux machine. I created a patern feeds index in kibana. Logstash receives Fortinet logs continuously. I created a patern fortinet index in kibana. My goal is … --- ## [Negative epoch\_millis sometimes throw error while indexing](https://discuss.elastic.co/t/negative-epoch-millis-sometimes-throw-error-while-indexing/260239)
**Author:** [@JulienNemo](https://discuss.elastic.co/u/JulienNemo)\ **Replies:** 3\ **Last updated:** [January 6, 2021, 9:15am UTC](https://discuss.elastic.co/t/negative-epoch-millis-sometimes-throw-error-while-indexing/260239 "2021-01-06T09:15:43Z")
Hi, version: 7.10.1 Have a"dateOfBirth": { "type": "date" } field. I can't index the document with the dateOfBirth:-1555200000 error : “reason”:“date\_time\_exception: Invalid value for Year (vali… --- ## [S3 Repository Plugin - curl: (52) Empty reply from server](https://discuss.elastic.co/t/s3-repository-plugin-curl-52-empty-reply-from-server/259447)
**Author:** [@bigbansal](https://discuss.elastic.co/u/bigbansal)\ **Replies:** 5\ **Last updated:** [January 6, 2021, 8:34am UTC](https://discuss.elastic.co/t/s3-repository-plugin-curl-52-empty-reply-from-server/259447 "2021-01-06T08:34:59Z")
Hi All, I am struggling to put data node's data to S3 Bucket and getting empty response from server. can u please suggest what could be the reason ? --elasticsearch.yml has path.repo: $s3\_Bucket/$s3\_Prefix/docroot --… --- ## [Cross-field atleast functionality (return documents where a term has x occurrences)](https://discuss.elastic.co/t/cross-field-atleast-functionality-return-documents-where-a-term-has-x-occurrences/260294)
**Author:** [@Daantie](https://discuss.elastic.co/u/Daantie)\ **Replies:** 0\ **Last updated:** [January 6, 2021, 8:23am UTC](https://discuss.elastic.co/t/cross-field-atleast-functionality-return-documents-where-a-term-has-x-occurrences/260294 "2021-01-06T08:23:22Z")
Hello! I'm working for a client in the patent domain. We have a feature called atleast that returns all documents where a term has a minimum of x occurrences. In the past a plugin was written for this (also mentioned he… --- ## [Initial\_master\_nodes case-sensitive to capitalized hostnames on Windows for v7.7.1](https://discuss.elastic.co/t/initial-master-nodes-case-sensitive-to-capitalized-hostnames-on-windows-for-v7-7-1/260264)
**Author:** [@cjcjameson](https://discuss.elastic.co/u/cjcjameson)\ **Replies:** 2\ **Last updated:** [January 6, 2021, 6:39am UTC](https://discuss.elastic.co/t/initial-master-nodes-case-sensitive-to-capitalized-hostnames-on-windows-for-v7-7-1/260264 "2021-01-06T06:39:36Z")
Hi there, We have a cluster on Windows where we're trying to launch Elasticsearch v7.7.1 . We are using cluster.initial\_master\_nodes , setting it to the host-names (we think). We are not setting node.name . We are being… --- ## [Elasticsearch Cardinality aggregation with condition](https://discuss.elastic.co/t/elasticsearch-cardinality-aggregation-with-condition/260275)
**Author:** [@rohitc.11](https://discuss.elastic.co/u/rohitc.11)\ **Replies:** 0\ **Last updated:** [January 6, 2021, 6:35am UTC](https://discuss.elastic.co/t/elasticsearch-cardinality-aggregation-with-condition/260275 "2021-01-06T06:35:04Z")
I want to do cardinality aggregation with condition. I want to count all the unique sellers whose sell sum should be greater than 100 for product list. Is there any way to do this using cardinality or anything else? I… --- ## [Kibana Granted document query for multiple filter](https://discuss.elastic.co/t/kibana-granted-document-query-for-multiple-filter/258607)
**Author:** [@anjali28](https://discuss.elastic.co/u/anjali28)\ **Replies:** 3\ **Last updated:** [January 6, 2021, 6:31am UTC](https://discuss.elastic.co/t/kibana-granted-document-query-for-multiple-filter/258607 "2021-01-06T06:31:25Z")
Hello, I have an requirement of creating a role which has limited permission of data in index privileges using granted document query. For example: User1 should be restricted when installation id: 1 and stageid:2 d ma… --- ## [Universal search across all Indices on Kibana?](https://discuss.elastic.co/t/universal-search-across-all-indices-on-kibana/260176)
**Author:** [@mohamed.farhan](https://discuss.elastic.co/u/mohamed.farhan)\ **Replies:** 2\ **Last updated:** [January 6, 2021, 4:59am UTC](https://discuss.elastic.co/t/universal-search-across-all-indices-on-kibana/260176 "2021-01-06T04:59:41Z")
Hello, I am trying to search/query to make sure I get the results regardless of indices. How can I do universal search ( across multiple indices ) in Kibana? Is it even possible? --- ## [Question regarding ES distribution of incoming requests](https://discuss.elastic.co/t/question-regarding-es-distribution-of-incoming-requests/260268)
**Author:** [@Amlan\_Kumar\_Rath](https://discuss.elastic.co/u/Amlan_Kumar_Rath)\ **Replies:** 0\ **Last updated:** [January 6, 2021, 3:19am UTC](https://discuss.elastic.co/t/question-regarding-es-distribution-of-incoming-requests/260268 "2021-01-06T03:19:53Z")
I have a 3 node cluster with 6 indices of 1 shard each and 2 replicas, in short the full copy of an index on each node. Now I know that when I make a search call by calling a particular node of the cluster with a query, … --- ## [Elasticsearch complaining about Shard limit](https://discuss.elastic.co/t/elasticsearch-complaining-about-shard-limit/260266)
**Author:** [@SteveHodges](https://discuss.elastic.co/u/SteveHodges)\ **Replies:** 4\ **Last updated:** [January 6, 2021, 2:59am UTC](https://discuss.elastic.co/t/elasticsearch-complaining-about-shard-limit/260266 "2021-01-06T02:59:44Z")
I have had this problem every other month. I just go in and close the oldest 2 months of indexes. That has been solving the problem up until this week. Even though the Elasticsearch stats pages tells me that I only h… --- ## [\[ERROR\]\[logstash.config.sourceloader\] No configuration found in the configured sources](https://discuss.elastic.co/t/error-logstash-config-sourceloader-no-configuration-found-in-the-configured-sources/260238)
**Author:** [@aandrewsllp](https://discuss.elastic.co/u/aandrewsllp)\ **Replies:** 2\ **Last updated:** [January 6, 2021, 2:35am UTC](https://discuss.elastic.co/t/error-logstash-config-sourceloader-no-configuration-found-in-the-configured-sources/260238 "2021-01-06T02:35:34Z")
help me!!!! --- ## [Take input from elk index and need to send notification over email against invalid inputs](https://discuss.elastic.co/t/take-input-from-elk-index-and-need-to-send-notification-over-email-against-invalid-inputs/260223)
**Author:** [@Maahi\_Gupta](https://discuss.elastic.co/u/Maahi_Gupta)\ **Replies:** 3\ **Last updated:** [January 6, 2021, 2:25am UTC](https://discuss.elastic.co/t/take-input-from-elk-index-and-need-to-send-notification-over-email-against-invalid-inputs/260223 "2021-01-06T02:25:56Z")
Hi, I m a newbie in elk and i have been trying the below code from quite sometime. This is the configuration file i have input { elasticsearch { hosts =\> 'localhost' index =\> 'filebeat-\*' } } output… --- ## [Send a notification mail for invalid inputs made to the index (filebeat)](https://discuss.elastic.co/t/send-a-notification-mail-for-invalid-inputs-made-to-the-index-filebeat/260227)
**Author:** [@nottyheadedboss](https://discuss.elastic.co/u/nottyheadedboss)\ **Replies:** 1\ **Last updated:** [January 6, 2021, 2:22am UTC](https://discuss.elastic.co/t/send-a-notification-mail-for-invalid-inputs-made-to-the-index-filebeat/260227 "2021-01-06T02:22:58Z")
HI, I have been trying to work on the code to send an email to the support team for any invalid inputs such as (Invalid Credentials) into the system. A case being, when I try to use Putty and invalid credentials are ent… --- ## [Enrich Processor is slow on multi nodes](https://discuss.elastic.co/t/enrich-processor-is-slow-on-multi-nodes/260245)
**Author:** [@Mike\_Connor](https://discuss.elastic.co/u/Mike_Connor)\ **Replies:** 9\ **Last updated:** [January 6, 2021, 2:21am UTC](https://discuss.elastic.co/t/enrich-processor-is-slow-on-multi-nodes/260245 "2021-01-06T02:21:57Z")
Hello, I am helping with a project that is using an ingest pipeline, specifically the enrich processor. The enrich processor is pulling from a source index that is fairly small (300k records, ~25MB). The documents that … --- ## [Windows Perfmon (DHCP) Dashboard](https://discuss.elastic.co/t/windows-perfmon-dhcp-dashboard/260263)
**Author:** [@efaile](https://discuss.elastic.co/u/efaile)\ **Replies:** 0\ **Last updated:** [January 6, 2021, 12:26am UTC](https://discuss.elastic.co/t/windows-perfmon-dhcp-dashboard/260263 "2021-01-06T00:26:52Z")
I'm new to the Elastic Stack - forgive me if this is a "Captain Obvious" question. We want to monitor some key services such as DHCP Declines that can be indicative of trouble. I installed the metricbeat on our Windows… --- ## [How to make the changes in filebeat effective](https://discuss.elastic.co/t/how-to-make-the-changes-in-filebeat-effective/260143)
**Author:** [@aagarwal3](https://discuss.elastic.co/u/aagarwal3)\ **Replies:** 21\ **Last updated:** [January 5, 2021, 8:59pm UTC](https://discuss.elastic.co/t/how-to-make-the-changes-in-filebeat-effective/260143 "2021-01-05T20:59:17Z")
Hello all, I am trying to use the filebeat.yml file for the first time. Since, the logs are being logged in a different country and sometimes I see an abrupt jump in the logs visibility. It might be (not sure) because p… --- ## [Elasticsearch-py support for search after](https://discuss.elastic.co/t/elasticsearch-py-support-for-search-after/260222)
**Author:** [@zuanni](https://discuss.elastic.co/u/zuanni)\ **Replies:** 1\ **Last updated:** [January 5, 2021, 10:40pm UTC](https://discuss.elastic.co/t/elasticsearch-py-support-for-search-after/260222 "2021-01-05T22:40:20Z")
Hi All, First time here, I apologize in case I post in the wrong way or area. I'm searching news about the support for https://www.elastic.co/guide/en/elasticsearch/reference/current/paginate-search-results.html#search… --- ## [Unable to access field outside \_source in Painless ingest processor](https://discuss.elastic.co/t/unable-to-access-field-outside-source-in-painless-ingest-processor/260247)
**Author:** [@marcosvrrs](https://discuss.elastic.co/u/marcosvrrs)\ **Replies:** 0\ **Last updated:** [January 5, 2021, 5:14pm UTC](https://discuss.elastic.co/t/unable-to-access-field-outside-source-in-painless-ingest-processor/260247 "2021-01-05T17:14:57Z")
Hi I can not figure out how to access a field that is outside the \_source. The grok processor with the field nested I can't access, or the rename processor too. Tried to access the data with ctx, \_source, \_index. Don't k… --- ## [Cannot do command to debug in logstash](https://discuss.elastic.co/t/cannot-do-command-to-debug-in-logstash/260259)
**Author:** [@Falikou1](https://discuss.elastic.co/u/Falikou1)\ **Replies:** 0\ **Last updated:** [January 5, 2021, 9:39pm UTC](https://discuss.elastic.co/t/cannot-do-command-to-debug-in-logstash/260259 "2021-01-05T21:39:39Z")
I can no longer make the following command: tail -f /var/log/logstash/logstash-plain.log I checked in / var / log / logstash / logstash-plain.log file no longer exists How can I fix this problem? --- ## [Handling high task count on daily index rollover](https://discuss.elastic.co/t/handling-high-task-count-on-daily-index-rollover/260214)
**Author:** [@OranShuster](https://discuss.elastic.co/u/OranShuster)\ **Replies:** 3\ **Last updated:** [January 5, 2021, 9:21pm UTC](https://discuss.elastic.co/t/handling-high-task-count-on-daily-index-rollover/260214 "2021-01-05T21:21:19Z")
Some stats about the cluster Version 6.5.0 3 master nodes 12 hot data+ingest nodes 16 vCPU 32GB mem (16GB heap) each 12 warm data+ingest nodes 8 vCPU 32GB mem (16GB heap) each 1 ingest node (added recently for tes… --- ## [Add Geopoint based off of parsed value to logstash config](https://discuss.elastic.co/t/add-geopoint-based-off-of-parsed-value-to-logstash-config/26580)
**Author:** [@russK](https://discuss.elastic.co/u/russK)\ **Replies:** 13\ **Last updated:** [January 5, 2021, 9:03pm UTC](https://discuss.elastic.co/t/add-geopoint-based-off-of-parsed-value-to-logstash-config/26580 "2021-01-05T21:03:45Z")
Hello, Part of my matched message returns the fields %{NUMBER:XCent} %{NUMBER:YCent} which are lat, long points. I'm attempting to add a location pin but keep getting a config failure when i use the --debug flag on… --- ## [Dynamic add/remove indexes alias](https://discuss.elastic.co/t/dynamic-add-remove-indexes-alias/260099)
**Author:** [@Cris.Oporto](https://discuss.elastic.co/u/Cris.Oporto)\ **Replies:** 3\ **Last updated:** [January 5, 2021, 8:55pm UTC](https://discuss.elastic.co/t/dynamic-add-remove-indexes-alias/260099 "2021-01-05T20:55:54Z")
Hi! Currently we are working with a ILP to manage indexes in hot/warm depending on their age. We have noticed retrieving documents from warm indexes is less performant than needed, so, we are thinking in a two steps dat… --- ## [Adding a node from an existing cluster to another cluster](https://discuss.elastic.co/t/adding-a-node-from-an-existing-cluster-to-another-cluster/260252)
**Author:** [@Ryan\_Clark](https://discuss.elastic.co/u/Ryan_Clark)\ **Replies:** 6\ **Last updated:** [January 5, 2021, 8:16pm UTC](https://discuss.elastic.co/t/adding-a-node-from-an-existing-cluster-to-another-cluster/260252 "2021-01-05T20:16:18Z")
I have a single elasticsearch node in it's own cluster (one node cluster) and I have different cluster that has 3 nodes. Both have their own set of data. I want to take the single node and add it to the 3 node cluster t… --- ## [Canvas make autorefresh permanent for user with lower permissions](https://discuss.elastic.co/t/canvas-make-autorefresh-permanent-for-user-with-lower-permissions/260212)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 1\ **Last updated:** [January 5, 2021, 8:15pm UTC](https://discuss.elastic.co/t/canvas-make-autorefresh-permanent-for-user-with-lower-permissions/260212 "2021-01-05T20:15:54Z")
Hi, It is posible to make autorefresh in canvas permanent? it seems that every time that the canvas app is loaded you have to set the autorefresh value --- ## [PostgreSQL Replication Data Metricbeat](https://discuss.elastic.co/t/postgresql-replication-data-metricbeat/260251)
**Author:** [@willis](https://discuss.elastic.co/u/willis)\ **Replies:** 0\ **Last updated:** [January 5, 2021, 7:57pm UTC](https://discuss.elastic.co/t/postgresql-replication-data-metricbeat/260251 "2021-01-05T19:57:09Z")
According to https://github.com/elastic/beats/issues/11234 the Metricbeat PostgreSQL module does not support pulling replication data. Is there a workaround to get important metrics like Replication Lag from PostgreSQL … --- ## [Checking shards creation](https://discuss.elastic.co/t/checking-shards-creation/260192)
**Author:** [@kirillmandrygin](https://discuss.elastic.co/u/kirillmandrygin)\ **Replies:** 1\ **Last updated:** [January 5, 2021, 7:54pm UTC](https://discuss.elastic.co/t/checking-shards-creation/260192 "2021-01-05T19:54:13Z")
When a node hits cluster.max\_shards\_per\_node limit, the cluster status remains green. Logs from elasticsearch: "Caused by: org.elasticsearch.common.ValidationException: Validation Failed: 1: this action would add \[… --- ## [Restore from S3 to multiple ES clusters in parallel](https://discuss.elastic.co/t/restore-from-s3-to-multiple-es-clusters-in-parallel/260250)
**Author:** [@Norman\_Khine](https://discuss.elastic.co/u/Norman_Khine)\ **Replies:** 4\ **Last updated:** [January 5, 2021, 7:48pm UTC](https://discuss.elastic.co/t/restore-from-s3-to-multiple-es-clusters-in-parallel/260250 "2021-01-05T19:48:18Z")
Hello, Would there be any issues with restoring to multiple ES clusters from a single snapshot in parallel from an S3 backup? Will be looking to restore specific indexes into different clusters. Or should this be done… --- ## [Trouble showing data in Vega-lite](https://discuss.elastic.co/t/trouble-showing-data-in-vega-lite/260216)
**Author:** [@Aishna\_Gupta](https://discuss.elastic.co/u/Aishna_Gupta)\ **Replies:** 8\ **Last updated:** [January 5, 2021, 6:47pm UTC](https://discuss.elastic.co/t/trouble-showing-data-in-vega-lite/260216 "2021-01-05T18:47:08Z")
Hello Everyone, I'm new to Vega-lite. I'm trying to plot a bar graph using Vega-lite getting data from an Index. But the data does not show up in the view, only the axes. This is the script I'm using: { "$sch… --- ## [Infinite loop of retryable error code=\>400](https://discuss.elastic.co/t/infinite-loop-of-retryable-error-code-400/260234)
**Author:** [@maxonage](https://discuss.elastic.co/u/maxonage)\ **Replies:** 2\ **Last updated:** [January 5, 2021, 6:09pm UTC](https://discuss.elastic.co/t/infinite-loop-of-retryable-error-code-400/260234 "2021-01-05T18:09:05Z")
Hello, We're using filebeat that sends data to logstash, suddenly we started receiving Encountered a retryable error. Will Retry with exponential backoff {:code=\>400, :url=\>"http://localhost:9200/\_bulk"} From filebea… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1616) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1618)