# Elastic Stack

**URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1622

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1623

---

## [How to compile Vega-Lite project to Vega?](https://discuss.elastic.co/t/how-to-compile-vega-lite-project-to-vega/259837)

<div class="topic-metadata">

**Author:** [@Ganymede](https://discuss.elastic.co/u/Ganymede)\
**Replies:** 4\
**Last updated:** [January 1, 2021, 6:50pm UTC](https://discuss.elastic.co/t/how-to-compile-vega-lite-project-to-vega/259837 "2021-01-01T18:50:18Z")

</div>

Hello all, Literally title. I have a working project in Vega-Lite and want to add "Vega only features" ontop of it. Is it possible to compile the Vega-Lite script and look at the resulting Vega output? As far as I'm …

---

## [Reading data trough mongodb -input](https://discuss.elastic.co/t/reading-data-trough-mongodb-input/259999)

<div class="topic-metadata">

**Author:** [@bucco1958](https://discuss.elastic.co/u/bucco1958)\
**Replies:** 1\
**Last updated:** [January 1, 2021, 5:39pm UTC](https://discuss.elastic.co/t/reading-data-trough-mongodb-input/259999 "2021-01-01T17:39:26Z")

</div>

I'm trying to learn more about the mongodb-input-plugin. I'm running a local mongo db instance on my localhost on my Win 10 machine. The database is up and used with other purposes. There is no security on the database -…

---

## [Automatic replications factor](https://discuss.elastic.co/t/automatic-replications-factor/259996)

<div class="topic-metadata">

**Author:** [@Itay\_Bittan](https://discuss.elastic.co/u/Itay_Bittan)\
**Replies:** 0\
**Last updated:** [January 1, 2021, 2:05pm UTC](https://discuss.elastic.co/t/automatic-replications-factor/259996 "2021-01-01T14:05:35Z")

</div>

Hi, I wonder if there is a feature for dynamically changing the replication\_factor of each index. We have an Elasticseach cluster with hundreds of indices as part of our recommendations engine. Each index represents a …

---

## [Elasticsearch remote cluster authentication](https://discuss.elastic.co/t/elasticsearch-remote-cluster-authentication/259991)

<div class="topic-metadata">

**Author:** [@xxlaila](https://discuss.elastic.co/u/xxlaila)\
**Replies:** 1\
**Last updated:** [January 1, 2021, 12:32pm UTC](https://discuss.elastic.co/t/elasticsearch-remote-cluster-authentication/259991 "2021-01-01T12:32:04Z")

</div>

Elasticsearch 7.8. Independent account authentication is configured between the two clusters, xpack.security.enabled : true xpack.security.transport . ssl.enabled : true xpack.security.transport . ssl.verificatio…

---

## [Has\_child not working as expected inside has\_parent](https://discuss.elastic.co/t/has-child-not-working-as-expected-inside-has-parent/259992)

<div class="topic-metadata">

**Author:** [@Waseem\_Farooqui](https://discuss.elastic.co/u/Waseem_Farooqui)\
**Replies:** 0\
**Last updated:** [January 1, 2021, 12:11pm UTC](https://discuss.elastic.co/t/has-child-not-working-as-expected-inside-has-parent/259992 "2021-01-01T12:11:35Z")

</div>

I have a parent child relationship in my elasticsearch 7.9 where I am having the car as a parent type and it has multiple child types like honda, suzuki, volvo now I want to have a child of type volvo and parent type is …

---

## [Data A first delete then index but version conflict](https://discuss.elastic.co/t/data-a-first-delete-then-index-but-version-conflict/259988)

<div class="topic-metadata">

**Author:** [@kai1](https://discuss.elastic.co/u/kai1)\
**Replies:** 1\
**Last updated:** [January 1, 2021, 9:49am UTC](https://discuss.elastic.co/t/data-a-first-delete-then-index-but-version-conflict/259988 "2021-01-01T09:49:38Z")

</div>

hello, everybody: I have a problem. I don\`t know why. Es(version is 6.3.2) index name is \[index\_1\]. Data A in index\_1, and version is 100 (version type is external). First, I Delete data A and search data A does not …

---

## [Watcher Assistance](https://discuss.elastic.co/t/watcher-assistance/259919)

<div class="topic-metadata">

**Author:** [@PinkElephant](https://discuss.elastic.co/u/PinkElephant)\
**Replies:** 2\
**Last updated:** [January 1, 2021, 5:10am UTC](https://discuss.elastic.co/t/watcher-assistance/259919 "2021-01-01T05:10:19Z")

</div>

Am trying to loop through a particular aggregation bucket-by-bucket and check if its corresponding key matches the value of ctx.payload.second.hits.hits.0.\_source.host.hostname. If it matches (and the hits total is \> 0 …

---

## [Can't access inner fields in JSON](https://discuss.elastic.co/t/cant-access-inner-fields-in-json/259978)

<div class="topic-metadata">

**Author:** [@ake](https://discuss.elastic.co/u/ake)\
**Replies:** 6\
**Last updated:** [December 31, 2020, 10:34pm UTC](https://discuss.elastic.co/t/cant-access-inner-fields-in-json/259978 "2020-12-31T22:34:50Z")

</div>

Hi everyone, I'm trying to extract some fields from JSON that I'm getting from MySQL and add it to ES. I've been going over way too many discussions here and some other sites but can't find the solution for my problem. …

---

## [Help reindexing to new index](https://discuss.elastic.co/t/help-reindexing-to-new-index/259932)

<div class="topic-metadata">

**Author:** [@jtillman2020](https://discuss.elastic.co/u/jtillman2020)\
**Replies:** 9\
**Last updated:** [December 31, 2020, 9:48pm UTC](https://discuss.elastic.co/t/help-reindexing-to-new-index/259932 "2020-12-31T21:48:54Z")

</div>

I have a logstash .conf file whos outputs originally look like this: if "PAN-OS\_config" in \[tags\] { elasticsearch { index =\> "config" hosts =\> \["localhost:9200"\] } This created indexes in Elasti…

---

## [What is ram.percent and heap.percent](https://discuss.elastic.co/t/what-is-ram-percent-and-heap-percent/259954)

<div class="topic-metadata">

**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\
**Replies:** 1\
**Last updated:** [December 31, 2020, 9:33pm UTC](https://discuss.elastic.co/t/what-is-ram-percent-and-heap-percent/259954 "2020-12-31T21:33:31Z")

</div>

GET /\_cat/nodes?v&pretty ip heap.percent ram.percent cpu load\_1m load\_5m load\_15m node.role master name XX.XX.XX.XX 73 99 30 2.06 1.60 1.10 d - ed1 XX.XX.XX.XX …

---

## [Instructions on Installing ELK stack from Source Code (github)](https://discuss.elastic.co/t/instructions-on-installing-elk-stack-from-source-code-github/259976)

<div class="topic-metadata">

**Author:** [@austinsonger](https://discuss.elastic.co/u/austinsonger)\
**Replies:** 1\
**Last updated:** [December 31, 2020, 9:30pm UTC](https://discuss.elastic.co/t/instructions-on-installing-elk-stack-from-source-code-github/259976 "2020-12-31T21:30:28Z")

</div>

IS there instructions somewhere how to install ELK stack from source code?

---

## [Best practice to install Kibana,Should it be on data, client or master node](https://discuss.elastic.co/t/best-practice-to-install-kibana-should-it-be-on-data-client-or-master-node/259951)

<div class="topic-metadata">

**Author:** [@atulthakre](https://discuss.elastic.co/u/atulthakre)\
**Replies:** 1\
**Last updated:** [December 31, 2020, 6:13pm UTC](https://discuss.elastic.co/t/best-practice-to-install-kibana-should-it-be-on-data-client-or-master-node/259951 "2020-12-31T18:13:03Z")

</div>

Currently we have created 8 Elastic Search machine.In that, we created 3 master node, 2 client-node and 3 data-node. we build separate machine and installed kibana. After that ,we point all 8 Elastic machine IP In yml f…

---

## [Sort on specific keyword in Discover using KQL](https://discuss.elastic.co/t/sort-on-specific-keyword-in-discover-using-kql/259948)

<div class="topic-metadata">

**Author:** [@dontask](https://discuss.elastic.co/u/dontask)\
**Replies:** 1\
**Last updated:** [December 31, 2020, 6:12pm UTC](https://discuss.elastic.co/t/sort-on-specific-keyword-in-discover-using-kql/259948 "2020-12-31T18:12:04Z")

</div>

Hello, I would like to sort on a specific (ascending / descending) on a column matching a specific keyword. The column is returning OK or ERROR and I would like the ERROR to be on top instead of the OK, but I still wan…

---

## [Fresh Install if ELK 7.10 floods deprecation log](https://discuss.elastic.co/t/fresh-install-if-elk-7-10-floods-deprecation-log/259821)

<div class="topic-metadata">

**Author:** [@JSylvia007](https://discuss.elastic.co/u/JSylvia007)\
**Replies:** 8\
**Last updated:** [December 31, 2020, 4:38pm UTC](https://discuss.elastic.co/t/fresh-install-if-elk-7-10-floods-deprecation-log/259821 "2020-12-31T16:38:49Z")

</div>

A fresh install of ELK 7.10 fills the deprecation log once Kibana is installed. \[2020-12-29T14:12:46,624\]\[DEPRECATION\]\[o.e.d.a.a.i.a.g.TransportGetAliasesAction\] \[app01\] this request accesses system indices: \[.kibana\_1\]…

---

## [Logstash HA](https://discuss.elastic.co/t/logstash-ha/258979)

<div class="topic-metadata">

**Author:** [@ksaha](https://discuss.elastic.co/u/ksaha)\
**Replies:** 5\
**Last updated:** [December 31, 2020, 3:51pm UTC](https://discuss.elastic.co/t/logstash-ha/258979 "2020-12-31T15:51:20Z")

</div>

Hi, Can anyone please provide what are the various options of implementing Logstash High Availability? I am aware of using at least two Logstash instance for Logstash HA. Is there any other way by which I can achieve L…

---

## [Logstash execption in pipeline worker](https://discuss.elastic.co/t/logstash-execption-in-pipeline-worker/259965)

<div class="topic-metadata">

**Author:** [@Mohammad\_Mousavi](https://discuss.elastic.co/u/Mohammad_Mousavi)\
**Replies:** 1\
**Last updated:** [December 31, 2020, 3:17pm UTC](https://discuss.elastic.co/t/logstash-execption-in-pipeline-worker/259965 "2020-12-31T15:17:26Z")

</div>

Hi, I have 4 logstash ( v7.4.2) services on 4 separate VMs. The logstash services keeps crashing after a while or few hours. This is the config: filter { ip2location { source =\> "clientip" …

---

## [Transaction metrics](https://discuss.elastic.co/t/transaction-metrics/259959)

<div class="topic-metadata">

**Author:** [@Jose\_Campos](https://discuss.elastic.co/u/Jose_Campos)\
**Replies:** 0\
**Last updated:** [December 31, 2020, 1:20pm UTC](https://discuss.elastic.co/t/transaction-metrics/259959 "2020-12-31T13:20:30Z")

</div>

hello everyone I have been working with metricbeat version 7.9.10, for windows server 2016 with MSSQL module. The problem I am having is that a day goes by and I stop receiving transaction metrics from the database but…

---

## [\[Logstash monitoring with metricbeat\]: http server gave http response to HTTPs client](https://discuss.elastic.co/t/logstash-monitoring-with-metricbeat-http-server-gave-http-response-to-https-client/259950)

<div class="topic-metadata">

**Author:** [@Abdelhalim](https://discuss.elastic.co/u/Abdelhalim)\
**Replies:** 0\
**Last updated:** [December 31, 2020, 10:22am UTC](https://discuss.elastic.co/t/logstash-monitoring-with-metricbeat-http-server-gave-http-response-to-https-client/259950 "2020-12-31T10:22:13Z")

</div>

Hello, I am trying to monitor my cluster using metricbeat, for elasticsearch and kibana nodes it's working perfectly, but when I try to monitor logstash I am getting these errors from my metricbeat logs 2020-12-31T11:0…

---

## [How can I calculate score using More-like-this in script score](https://discuss.elastic.co/t/how-can-i-calculate-score-using-more-like-this-in-script-score/259949)

<div class="topic-metadata">

**Author:** [@111424](https://discuss.elastic.co/u/111424)\
**Replies:** 0\
**Last updated:** [December 31, 2020, 9:59am UTC](https://discuss.elastic.co/t/how-can-i-calculate-score-using-more-like-this-in-script-score/259949 "2020-12-31T09:59:55Z")

</div>

Hi. I'm writing a query for searching engine. I want to calculate the score using cosine similarity(between image feature vectors) and tfidf. So, I used "function\_score" to calculate weighted sum of more-like-this sc…

---

## [How to calculate Shard size](https://discuss.elastic.co/t/how-to-calculate-shard-size/259945)

<div class="topic-metadata">

**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\
**Replies:** 2\
**Last updated:** [December 31, 2020, 9:20am UTC](https://discuss.elastic.co/t/how-to-calculate-shard-size/259945 "2020-12-31T09:20:12Z")

</div>

i don't know how to calculate shard size suppose we have 2499 shards and 443 indices and its data size 650gb

---

## [Sharding for hidden index in elasticsearch](https://discuss.elastic.co/t/sharding-for-hidden-index-in-elasticsearch/259941)

<div class="topic-metadata">

**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\
**Replies:** 5\
**Last updated:** [December 31, 2020, 9:13am UTC](https://discuss.elastic.co/t/sharding-for-hidden-index-in-elasticsearch/259941 "2020-12-31T09:13:47Z")

</div>

Hidden index like .kibana,.monitoring-logstash-7,.kibana-event-log-7,.kibana\_task\_manager\_2 etc do we need to really care about sharding of these indices like we create 3 shards for winlogbeat 3 shards for packetbeat and…

---

## [Elasticsearch Cross Cluster Search Implementation](https://discuss.elastic.co/t/elasticsearch-cross-cluster-search-implementation/259708)

<div class="topic-metadata">

**Author:** [@tusharnemade](https://discuss.elastic.co/u/tusharnemade)\
**Replies:** 14\
**Last updated:** [December 31, 2020, 8:44am UTC](https://discuss.elastic.co/t/elasticsearch-cross-cluster-search-implementation/259708 "2020-12-31T08:44:28Z")

</div>

Hello Team I am using Elasticsearch version 7.8.0. I am having two clusters : a. Local cluster b. remote cluster. Remote Cluster has Authentication implemented with CA Certificates generated for himself. Similarly …

---

## [Elasticsearch configure the client to trust this certificate](https://discuss.elastic.co/t/elasticsearch-configure-the-client-to-trust-this-certificate/259710)

<div class="topic-metadata">

**Author:** [@tusharnemade](https://discuss.elastic.co/u/tusharnemade)\
**Replies:** 9\
**Last updated:** [December 31, 2020, 8:37am UTC](https://discuss.elastic.co/t/elasticsearch-configure-the-client-to-trust-this-certificate/259710 "2020-12-31T08:37:10Z")

</div>

Hi Team I am using Elasticsearch Version 7.8.0 I have generated CA Certificate and keys using "elasticsearch-certutil" utility. These certificates are in format PKCS#12. Could you please help me in configure the clie…

---

## [Custom visualisation with Kibana](https://discuss.elastic.co/t/custom-visualisation-with-kibana/259876)

<div class="topic-metadata">

**Author:** [@BenoitSERRA](https://discuss.elastic.co/u/BenoitSERRA)\
**Replies:** 10\
**Last updated:** [December 31, 2020, 7:42am UTC](https://discuss.elastic.co/t/custom-visualisation-with-kibana/259876 "2020-12-31T07:42:01Z")

</div>

Hello, I'm planning to use Kibana to display the worst screens displayed by users. I load the data from our transaction monitors in Elasticsearch using logstash. For each transaction, I have the duration of it loaded. …

---

## [Image recognition issue on elastic search](https://discuss.elastic.co/t/image-recognition-issue-on-elastic-search/259868)

<div class="topic-metadata">

**Author:** [@prasad.nueve](https://discuss.elastic.co/u/prasad.nueve)\
**Replies:** 1\
**Last updated:** [December 31, 2020, 7:37am UTC](https://discuss.elastic.co/t/image-recognition-issue-on-elastic-search/259868 "2020-12-31T07:37:39Z")

</div>

Hi We have used elastic search apis for image recognition purpose. There are a set of images data from AWS Image Recognition and saved in ElasticSearch. The image with frame was in ElasticSearch. I am using the secon…

---

## [Need the vCPU requirement for GCP](https://discuss.elastic.co/t/need-the-vcpu-requirement-for-gcp/259148)

<div class="topic-metadata">

**Author:** [@Siva\_Karan](https://discuss.elastic.co/u/Siva_Karan)\
**Replies:** 12\
**Last updated:** [December 31, 2020, 7:34am UTC](https://discuss.elastic.co/t/need-the-vcpu-requirement-for-gcp/259148 "2020-12-31T07:34:00Z")

</div>

Hi Team, we are plan to move our Elasticsearch environment to Google cloud platform, our cluster have 3 master nodes+ 5 data nodes having 423 indices,2100 shards How many vCPU need to allocate for each node, please…

---

## [Elasticsearch template in Logstash doesn't mapping and not able to sort fields](https://discuss.elastic.co/t/elasticsearch-template-in-logstash-doesnt-mapping-and-not-able-to-sort-fields/259937)

<div class="topic-metadata">

**Author:** [@rknd](https://discuss.elastic.co/u/rknd)\
**Replies:** 0\
**Last updated:** [December 31, 2020, 7:30am UTC](https://discuss.elastic.co/t/elasticsearch-template-in-logstash-doesnt-mapping-and-not-able-to-sort-fields/259937 "2020-12-31T07:30:18Z")

</div>

I want to sort datas via elasticsearch rest client, I want to get data that match with the name "match\_field", after this match sort via "int\_var", below is my template in logstash. { "index\_patterns": \["index\_name"\]…

---

## [Configure xpack basic authentication](https://discuss.elastic.co/t/configure-xpack-basic-authentication/259916)

<div class="topic-metadata">

**Author:** [@dis](https://discuss.elastic.co/u/dis)\
**Replies:** 5\
**Last updated:** [December 31, 2020, 6:01am UTC](https://discuss.elastic.co/t/configure-xpack-basic-authentication/259916 "2020-12-31T06:01:23Z")

</div>

ES: 7.10.2-SNAPSHOT with basic/trial license. I want to run elasticsearch with xpack enabled as basic authentication. xpack.security.enabled: true xpack.security.authc.realms: native.realm1: order: 0 running in…

---

## [Get and modify \_system internal user permissions](https://discuss.elastic.co/t/get-and-modify-system-internal-user-permissions/259574)

<div class="topic-metadata">

**Author:** [@Ahmad\_Al-Masry](https://discuss.elastic.co/u/Ahmad_Al-Masry)\
**Replies:** 3\
**Last updated:** [December 31, 2020, 2:47am UTC](https://discuss.elastic.co/t/get-and-modify-system-internal-user-permissions/259574 "2020-12-31T02:47:41Z")

</div>

Hi; Can I get what \_system internal user can do when xpack-security is enabled? Also, can I modify what it can do or give it extra permissions?

---

## [Sanity check on ILM](https://discuss.elastic.co/t/sanity-check-on-ilm/259306)

<div class="topic-metadata">

**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\
**Replies:** 2\
**Last updated:** [December 31, 2020, 1:26am UTC](https://discuss.elastic.co/t/sanity-check-on-ilm/259306 "2020-12-31T01:26:50Z")

</div>

I have spent the last 3 weeks off and on trying to get ILM to work. I have datastreams going but one client I am using (syslog-ng) does not yet know about datastreams and uses index in the \_bulk rather than create. I f…

[Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1621)

[Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1623)
