# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1618 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1619 --- ## [Terms query with large number of items increase latency by number of shards](https://discuss.elastic.co/t/terms-query-with-large-number-of-items-increase-latency-by-number-of-shards/259769)
**Author:** [@nickcanz](https://discuss.elastic.co/u/nickcanz)\ **Replies:** 3\ **Last updated:** [January 5, 2021, 5:57pm UTC](https://discuss.elastic.co/t/terms-query-with-large-number-of-items-increase-latency-by-number-of-shards/259769 "2021-01-05T17:57:48Z")
For requests with a very high terms count, Elasticsearch is taking multiple seconds to return an HTTP 400 error. We had an issue with a production system that produced a query that had 250K items in a terms query and thi… --- ## [Elasticsearch 7.5 erros?](https://discuss.elastic.co/t/elasticsearch-7-5-erros/260105)
**Author:** [@Beuhlet\_Reseau](https://discuss.elastic.co/u/Beuhlet_Reseau)\ **Replies:** 6\ **Last updated:** [January 5, 2021, 5:54pm UTC](https://discuss.elastic.co/t/elasticsearch-7-5-erros/260105 "2021-01-05T17:54:05Z")
Hello, Happy new year. It seems Spark Streaming job was slow into Elasticsearch. I check master and find this erros in log ? \[...\] only morning : \[2021-01-04T01:59:56,349\]\[WARN \]\[o.e.x.m.e.l.LocalExporter\] \[opu309\_m… --- ## [Hot-Warm Architecture with ILM: Cluster health turns yellow](https://discuss.elastic.co/t/hot-warm-architecture-with-ilm-cluster-health-turns-yellow/260244)
**Author:** [@Eduardo\_Iglesias](https://discuss.elastic.co/u/Eduardo_Iglesias)\ **Replies:** 6\ **Last updated:** [January 5, 2021, 5:47pm UTC](https://discuss.elastic.co/t/hot-warm-architecture-with-ilm-cluster-health-turns-yellow/260244 "2021-01-05T17:47:37Z")
Hello community, I'm trying to implement a hot warm architecture but I can't make it work, the cluster health turns yellow. Below are the details of my cluster and some outputs: GET \_cat/indices yellow open test-0000… --- ## [Watcher Exception - Could Not Parse: Unknown Action Type "foreach"](https://discuss.elastic.co/t/watcher-exception-could-not-parse-unknown-action-type-foreach/258631)
**Author:** [@ravinb86](https://discuss.elastic.co/u/ravinb86)\ **Replies:** 3\ **Last updated:** [January 5, 2021, 4:40pm UTC](https://discuss.elastic.co/t/watcher-exception-could-not-parse-unknown-action-type-foreach/258631 "2021-01-05T16:40:15Z")
Hello There, I have a basic watcher to see no. of hits based on a query and send an email per hit. i.e. if my query returns 5 hits, I need to be able to send 5 different emails. To loop through the hits in an array: I f… --- ## [Timelion percentage calculation anomalies](https://discuss.elastic.co/t/timelion-percentage-calculation-anomalies/260137)
**Author:** [@stevezemlicka](https://discuss.elastic.co/u/stevezemlicka)\ **Replies:** 2\ **Last updated:** [January 5, 2021, 4:29pm UTC](https://discuss.elastic.co/t/timelion-percentage-calculation-anomalies/260137 "2021-01-05T16:29:18Z")
I am having an issue with a timelion visualization that calculates the percentage loss. It does this by summing one value from one index and subtracting another value from a different index, the dividing by the original… --- ## [Unable to delete the documents when the index is full](https://discuss.elastic.co/t/unable-to-delete-the-documents-when-the-index-is-full/260201)
**Author:** [@subash](https://discuss.elastic.co/u/subash)\ **Replies:** 6\ **Last updated:** [January 5, 2021, 4:21pm UTC](https://discuss.elastic.co/t/unable-to-delete-the-documents-when-the-index-is-full/260201 "2021-01-05T16:21:43Z")
I am unable to delete the documents from an index having the maximum number of documents (2147483519). getting the below exception. Please help me to get this resolved. "cause" : { "type" : "illegal\_argument\_ex… --- ## [Show different Metrics in one Visualization](https://discuss.elastic.co/t/show-different-metrics-in-one-visualization/260226)
**Author:** [@grra](https://discuss.elastic.co/u/grra)\ **Replies:** 6\ **Last updated:** [January 5, 2021, 4:19pm UTC](https://discuss.elastic.co/t/show-different-metrics-in-one-visualization/260226 "2021-01-05T16:19:56Z")
Hi, in my document I have a JSON metrics field like that: { "task": "task1", "size": 2048 }, { "task": "task2", "size": 1000 } As Buckets I have another field called number (lets say number: 1, 2) A field num… --- ## [ML Advanced datafeed Elasticsearch Query](https://discuss.elastic.co/t/ml-advanced-datafeed-elasticsearch-query/260219)
**Author:** [@Elk\_huh](https://discuss.elastic.co/u/Elk_huh)\ **Replies:** 1\ **Last updated:** [January 5, 2021, 3:49pm UTC](https://discuss.elastic.co/t/ml-advanced-datafeed-elasticsearch-query/260219 "2021-01-05T15:49:30Z")
How do i do query for event.code == 4625 winlog.event\_data.targetusername != "\*svc" this is what i have and doesnt seem to work { "bool": { "must": \[ { "match\_all": {} } \], "filter": \[ { "match\_phrase": { "… --- ## [Render kibana dashboard with API call in Angular10 application](https://discuss.elastic.co/t/render-kibana-dashboard-with-api-call-in-angular10-application/260225)
**Author:** [@manashreea](https://discuss.elastic.co/u/manashreea)\ **Replies:** 1\ **Last updated:** [January 5, 2021, 3:48pm UTC](https://discuss.elastic.co/t/render-kibana-dashboard-with-api-call-in-angular10-application/260225 "2021-01-05T15:48:50Z")
Hello, I want to display Kibana dashboard into Angular application. I know we can use embed url and set iframe src attribute. But I want to get dashboard report by making Kibana dashboard API call. And this API response… --- ## [How to avoid duplicate data in data table visualization](https://discuss.elastic.co/t/how-to-avoid-duplicate-data-in-data-table-visualization/260182)
**Author:** [@abhinav3](https://discuss.elastic.co/u/abhinav3)\ **Replies:** 1\ **Last updated:** [January 5, 2021, 3:39pm UTC](https://discuss.elastic.co/t/how-to-avoid-duplicate-data-in-data-table-visualization/260182 "2021-01-05T15:39:26Z")
I have data where I have customer names and devices linked to it. I want to visualize this on a data table. For this, I have added top hit as aggregation in metrics and have used field as Device. In the bucket, I have a… --- ## [Logstash Persistent Queue Buffer time](https://discuss.elastic.co/t/logstash-persistent-queue-buffer-time/260211)
**Author:** [@ksaha](https://discuss.elastic.co/u/ksaha)\ **Replies:** 2\ **Last updated:** [January 5, 2021, 2:29pm UTC](https://discuss.elastic.co/t/logstash-persistent-queue-buffer-time/260211 "2021-01-05T14:29:04Z")
Hi, I am exploring on Logstash resiliency part and come to know about the logstash Persistent Queue. I am searching what is the maximum buffer time of this Persistent Queue? Our requirement is the buffer should hold the… --- ## [AWS EC2 Logstash input with external IPs](https://discuss.elastic.co/t/aws-ec2-logstash-input-with-external-ips/260202)
**Author:** [@Sunflower](https://discuss.elastic.co/u/Sunflower)\ **Replies:** 0\ **Last updated:** [January 5, 2021, 12:16pm UTC](https://discuss.elastic.co/t/aws-ec2-logstash-input-with-external-ips/260202 "2021-01-05T12:16:20Z")
(topic withdrawn by author, will be automatically deleted in 24 hours unless flagged) --- ## [Using kibana alerting with filters](https://discuss.elastic.co/t/using-kibana-alerting-with-filters/259956)
**Author:** [@VAX](https://discuss.elastic.co/u/VAX)\ **Replies:** 1\ **Last updated:** [January 5, 2021, 2:19pm UTC](https://discuss.elastic.co/t/using-kibana-alerting-with-filters/259956 "2021-01-05T14:19:10Z")
hi all, im quite new with kibana i have kibana filled with messages coming from my equipment. i created an inverted filtered of "blacklist" so i will see the only ones i care about. now i want to create an alert that… --- ## [Filebeat stopped sending the log entries](https://discuss.elastic.co/t/filebeat-stopped-sending-the-log-entries/260217)
**Author:** [@Saravana37](https://discuss.elastic.co/u/Saravana37)\ **Replies:** 1\ **Last updated:** [January 5, 2021, 2:13pm UTC](https://discuss.elastic.co/t/filebeat-stopped-sending-the-log-entries/260217 "2021-01-05T14:13:48Z")
Hello , We have a typical issue here. Filebeat suddenly stopped sending the log entries and i can see the below message in the log. 2021-01-05T14:58:50.314+0100 INFO \[monitoring\] log/log.go:144 Non-zero metr… --- ## [How to save large data send from logstash to Redis with list type?](https://discuss.elastic.co/t/how-to-save-large-data-send-from-logstash-to-redis-with-list-type/260210)
**Author:** [@iooi](https://discuss.elastic.co/u/iooi)\ **Replies:** 0\ **Last updated:** [January 5, 2021, 1:30pm UTC](https://discuss.elastic.co/t/how-to-save-large-data-send-from-logstash-to-redis-with-list-type/260210 "2021-01-05T13:30:24Z")
I'm using logstash to send data to Redis as output { redis { host =\> \["${REDIS\_URL}"\] data\_type =\> "list" key =\> "ID" codec =\> line { format =\> "%{id}"} } } When I check data in Redis, it created an… --- ## [LogStash::Outputs::ElasticSearch::HttpClient::Pool::BadResponseCodeError: Got response code '401' contacting Elasticsearc](https://discuss.elastic.co/t/logstash-got-response-code-401-contacting-elasticsearc/260209)
**Author:** [@gitusersybchina](https://discuss.elastic.co/u/gitusersybchina)\ **Replies:** 0\ **Last updated:** [January 5, 2021, 1:27pm UTC](https://discuss.elastic.co/t/logstash-got-response-code-401-contacting-elasticsearc/260209 "2021-01-05T13:27:31Z")
when I deploy logstash in k8s and config out to es，the pod has occur this error log: LogStash::Outputs::ElasticSearch::HttpClient::Pool::BadResponseCodeError: Got response code '401' contacting Elasticsearch Failed to … --- ## [Elastic receives small amount of data and nginx buffers the bulk events](https://discuss.elastic.co/t/elastic-receives-small-amount-of-data-and-nginx-buffers-the-bulk-events/259578)
**Author:** [@opouwels](https://discuss.elastic.co/u/opouwels)\ **Replies:** 6\ **Last updated:** [January 5, 2021, 12:30pm UTC](https://discuss.elastic.co/t/elastic-receives-small-amount-of-data-and-nginx-buffers-the-bulk-events/259578 "2021-01-05T12:30:22Z")
Hi List, Sinces we switched from fluentd to fluent-bit our elastic cluster showed more problems with the bulk queue, is their a way to see whats in the bulk queue and why its not progressing the queue? the nginx shows … --- ## [Pause Young (Allocation Failure) in gc.log](https://discuss.elastic.co/t/pause-young-allocation-failure-in-gc-log/260100)
**Author:** [@mtudisco](https://discuss.elastic.co/u/mtudisco)\ **Replies:** 2\ **Last updated:** [January 5, 2021, 12:24pm UTC](https://discuss.elastic.co/t/pause-young-allocation-failure-in-gc-log/260100 "2021-01-05T12:24:26Z")
Hi, I've been having these errors in gc.log in elasticsearch (7.3), and sometimes elasticsearch crushes, dont know if because of theese errors. Can anyone help to identifiy what does it mean? \[2021-01-04T14:36:14.097+0… --- ## [Logs correlation](https://discuss.elastic.co/t/logs-correlation/260110)
**Author:** [@sm\_loguser](https://discuss.elastic.co/u/sm_loguser)\ **Replies:** 2\ **Last updated:** [January 5, 2021, 12:22pm UTC](https://discuss.elastic.co/t/logs-correlation/260110 "2021-01-05T12:22:47Z")
I have two log files. I am correlating these two files by timestamp using aggregate filter. Where there is timestamp match between two files, correlation is working fine. But there are scenarios where either of the two… --- ## [Classification of String Data](https://discuss.elastic.co/t/classification-of-string-data/260194)
**Author:** [@Andrey\_Maksimov](https://discuss.elastic.co/u/Andrey_Maksimov)\ **Replies:** 2\ **Last updated:** [January 5, 2021, 12:19pm UTC](https://discuss.elastic.co/t/classification-of-string-data/260194 "2021-01-05T12:19:53Z")
hey there, i have a task to classify download stats (basically, that's URL + some minor but yet valuable fields like referring host, request country, etc) of open-source products our company provide into metadata like s… --- ## [Elasticsearch 6.8.12 os.cpu always 100 although load varies and stays below number of processors](https://discuss.elastic.co/t/elasticsearch-6-8-12-os-cpu-always-100-although-load-varies-and-stays-below-number-of-processors/260136)
**Author:** [@span](https://discuss.elastic.co/u/span)\ **Replies:** 5\ **Last updated:** [January 5, 2021, 11:28am UTC](https://discuss.elastic.co/t/elasticsearch-6-8-12-os-cpu-always-100-although-load-varies-and-stays-below-number-of-processors/260136 "2021-01-05T11:28:21Z")
I have a small elastic cluster running on Kubernetes 1.18 in AKS. It has 3 ingest nodes, 3 masters and 4 data nodes. I do not have much data, only a few gigabytes spread over a dozen indices. It has been setup using Helm… --- ## [Hot/Warm architecture question](https://discuss.elastic.co/t/hot-warm-architecture-question/260119)
**Author:** [@frichard](https://discuss.elastic.co/u/frichard)\ **Replies:** 2\ **Last updated:** [January 5, 2021, 11:02am UTC](https://discuss.elastic.co/t/hot-warm-architecture-question/260119 "2021-01-05T11:02:14Z")
Hi everyone ! I am discussing Elasticsearch architecture with my team, and we wondered if the following setup would work : 2 hot nodes 2 warm nodes As a constraint, each index would have 1 replica for high availabili… --- ## [How to disable the new index creation mechanism whenever I ran Kibana 7.5.1?](https://discuss.elastic.co/t/how-to-disable-the-new-index-creation-mechanism-whenever-i-ran-kibana-7-5-1/259973)
**Author:** [@Zaga](https://discuss.elastic.co/u/Zaga)\ **Replies:** 4\ **Last updated:** [January 5, 2021, 10:51am UTC](https://discuss.elastic.co/t/how-to-disable-the-new-index-creation-mechanism-whenever-i-ran-kibana-7-5-1/259973 "2021-01-05T10:51:04Z")
Unlike in Kibana 6, I keep getting new indexes generated whenever I run my Kibana 7.5.1 instance .kibana\_1, .kibana\_2 etc. Why is it happening? can I disable it? it costs a lot of time and space to my development proce… --- ## [Kibana server is not ready: Error obtained after fresh installation on CentOS 7](https://discuss.elastic.co/t/kibana-server-is-not-ready-error-obtained-after-fresh-installation-on-centos-7/260171)
**Author:** [@jatomode](https://discuss.elastic.co/u/jatomode)\ **Replies:** 8\ **Last updated:** [January 5, 2021, 10:32am UTC](https://discuss.elastic.co/t/kibana-server-is-not-ready-error-obtained-after-fresh-installation-on-centos-7/260171 "2021-01-05T10:32:29Z")
I freshly installed Ossec and required Kibana for visual log report and dashboard, but after following steps https://www.linode.com/docs/guides/visualize-server-security-on-centos-7-with-an-elastic-stack-and-wazuh/ all s… --- ## [How to add fileds to index pattren , so it can be filterd by in discover search](https://discuss.elastic.co/t/how-to-add-fileds-to-index-pattren-so-it-can-be-filterd-by-in-discover-search/259969)
**Author:** [@umen](https://discuss.elastic.co/u/umen)\ **Replies:** 6\ **Last updated:** [January 5, 2021, 10:31am UTC](https://discuss.elastic.co/t/how-to-add-fileds-to-index-pattren-so-it-can-be-filterd-by-in-discover-search/259969 "2021-01-05T10:31:21Z")
i defined simple index pattern " filebeat-\*" and it has only a few fields which i can filter by: now i like to add new fields to this index pattern. which i can see they exist but i can't find anywhere how to ad… --- ## [Label is not shown for some categories in pie chart](https://discuss.elastic.co/t/label-is-not-shown-for-some-categories-in-pie-chart/259547)
**Author:** [@Pranusha119](https://discuss.elastic.co/u/Pranusha119)\ **Replies:** 4\ **Last updated:** [January 5, 2021, 10:23am UTC](https://discuss.elastic.co/t/label-is-not-shown-for-some-categories-in-pie-chart/259547 "2021-01-05T10:23:50Z")
Here label is not shown for one category in pie chart, may I know how it can be resolved. --- ## [Set default time field on ingest\_timestamp](https://discuss.elastic.co/t/set-default-time-field-on-ingest-timestamp/260184)
**Author:** [@pat7](https://discuss.elastic.co/u/pat7)\ **Replies:** 0\ **Last updated:** [January 5, 2021, 9:54am UTC](https://discuss.elastic.co/t/set-default-time-field-on-ingest-timestamp/260184 "2021-01-05T09:54:55Z")
hi! i'm adding (w/ an ingest pipeline) an ingest\_timestamp to each document on my index. poorly I cannot use the kibana date picker on that data. how is it possible to set the default time field on an ingest\_timestamp? I… --- ## [How can I get all nouns in my field](https://discuss.elastic.co/t/how-can-i-get-all-nouns-in-my-field/260181)
**Author:** [@akamachi95](https://discuss.elastic.co/u/akamachi95)\ **Replies:** 0\ **Last updated:** [January 5, 2021, 9:19am UTC](https://discuss.elastic.co/t/how-can-i-get-all-nouns-in-my-field/260181 "2021-01-05T09:19:45Z")
Sorry fo my poor English. As kuromoji, I can just use part of speech to filter out the useless words and keep the words I want. For English, I want to do the same thin.So is there any way for me to do the same thing? --- ## [Limit number of slices in pie chart](https://discuss.elastic.co/t/limit-number-of-slices-in-pie-chart/260049)
**Author:** [@kasun](https://discuss.elastic.co/u/kasun)\ **Replies:** 5\ **Last updated:** [January 5, 2021, 8:49am UTC](https://discuss.elastic.co/t/limit-number-of-slices-in-pie-chart/260049 "2021-01-05T08:49:17Z")
I have created a pie chart and split the slices using filter aggregation. There are over 5 filters but I want to display only the top 5 values in the pie chart. I can do this if I use the terms as the aggregation. But i… --- ## [We already have an ES cluster running WITHOUT authentication and TLS. We are trying to enable the security feature. Is it possible to achieve this with zero down time?](https://discuss.elastic.co/t/we-already-have-an-es-cluster-running-without-authentication-and-tls-we-are-trying-to-enable-the-security-feature-is-it-possible-to-achieve-this-with-zero-down-time/260153)
**Author:** [@liwanjie](https://discuss.elastic.co/u/liwanjie)\ **Replies:** 9\ **Last updated:** [January 5, 2021, 8:46am UTC](https://discuss.elastic.co/t/we-already-have-an-es-cluster-running-without-authentication-and-tls-we-are-trying-to-enable-the-security-feature-is-it-possible-to-achieve-this-with-zero-down-time/260153 "2021-01-05T08:46:05Z")
Hello, I have encountered the problem mentioned above. I encountered it during the rolling upgrade of elasticsearch 6.8.1 to 7.8.1. Because my 6.8.1 did not configure xpack related configuration, but I want to configu… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1617) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1619)