# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1623 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1624 --- ## [Cross cluster search](https://discuss.elastic.co/t/cross-cluster-search/259788)
**Author:** [@kannan\_raj](https://discuss.elastic.co/u/kannan_raj)\ **Replies:** 2\ **Last updated:** [December 30, 2020, 10:29pm UTC](https://discuss.elastic.co/t/cross-cluster-search/259788 "2020-12-30T22:29:28Z")
we have more than 20 elasticsearch cluster and we are planning to use cross cluster search for searching the data across all the cluster. could you please let me know that is there any limitation for adding remote clust… --- ## [Facing issue with Logstash 7.6.2 \[logstash.outputs.elasticsearch\]\[.monitoring-logstash\] Encountered a retryable error](https://discuss.elastic.co/t/facing-issue-with-logstash-7-6-2-logstash-outputs-elasticsearch-monitoring-logstash-encountered-a-retryable-error/259923)
**Author:** [@Usman18](https://discuss.elastic.co/u/Usman18)\ **Replies:** 1\ **Last updated:** [December 30, 2020, 10:23pm UTC](https://discuss.elastic.co/t/facing-issue-with-logstash-7-6-2-logstash-outputs-elasticsearch-monitoring-logstash-encountered-a-retryable-error/259923 "2020-12-30T22:23:43Z")
I have upgraded logstash and now I am using logstash version 7.6.2. My elasticsearch version is 6.8.13. After upgrade, I see a lot of error logs related to monitoring-logstash pipeline. The log of this error is given bel… --- ## [Elastic stack 7.9.2 - my /var/lib/docker is heavy](https://discuss.elastic.co/t/elastic-stack-7-9-2-my-var-lib-docker-is-heavy/259880)
**Author:** [@Waxman](https://discuss.elastic.co/u/Waxman)\ **Replies:** 0\ **Last updated:** [December 30, 2020, 12:30pm UTC](https://discuss.elastic.co/t/elastic-stack-7-9-2-my-var-lib-docker-is-heavy/259880 "2020-12-30T12:30:27Z")
Hi Everyone, I've noticed that my folder /var/lib/docker is pretty huge for all ELK nodes. It's from 2GB up to 6GB (depending on how many dockers is running on a virtual server). When I stop running dockers (let's say o… --- ## [\[o.e.x.s.t.n.securityNetty4ServerTransport\] Send message failed NettyTcpchannel](https://discuss.elastic.co/t/o-e-x-s-t-n-securitynetty4servertransport-send-message-failed-nettytcpchannel/259921)
**Author:** [@anil\_sunkesula](https://discuss.elastic.co/u/anil_sunkesula)\ **Replies:** 0\ **Last updated:** [December 30, 2020, 9:26pm UTC](https://discuss.elastic.co/t/o-e-x-s-t-n-securitynetty4servertransport-send-message-failed-nettytcpchannel/259921 "2020-12-30T21:26:35Z")
I am getting below warning in my Elasticsearch cluster logs. \[Warn\] \[o.e.x.s.t.n.securityNetty4ServerTransport\] Send message failed send message failed \[Channel: NettyTcpchannel{localAddress=0.0.0/0.0.0.0:9300}, remot… --- ## [I made some multi-arch filebeat alpine images](https://discuss.elastic.co/t/i-made-some-multi-arch-filebeat-alpine-images/259920)
**Author:** [@Martin\_Norrsken](https://discuss.elastic.co/u/Martin_Norrsken)\ **Replies:** 0\ **Last updated:** [December 30, 2020, 9:17pm UTC](https://discuss.elastic.co/t/i-made-some-multi-arch-filebeat-alpine-images/259920 "2020-12-30T21:17:48Z")
I've been building filebeat for alpine to run as a sidecar to other containers (specifically for shipping traefik access logs) and I have to say that the build process is overcomplicated with dependencies all over the pl… --- ## [Is there way to sort graphs in visualization?](https://discuss.elastic.co/t/is-there-way-to-sort-graphs-in-visualization/258425)
**Author:** [@jhagen92](https://discuss.elastic.co/u/jhagen92)\ **Replies:** 7\ **Last updated:** [December 30, 2020, 9:10pm UTC](https://discuss.elastic.co/t/is-there-way-to-sort-graphs-in-visualization/258425 "2020-12-30T21:10:48Z")
Hi. I have a heatmap in one visualization. I have 3 sources, so I split chart by column by source, which creates 3 heatmaps. Let's say source A, B, and C. Currently, order is A,B,C. I can change using Order, but it onl… --- ## [Scaling logstash nodes](https://discuss.elastic.co/t/scaling-logstash-nodes/259792)
**Author:** [@David\_Beradze](https://discuss.elastic.co/u/David_Beradze)\ **Replies:** 6\ **Last updated:** [December 30, 2020, 7:43pm UTC](https://discuss.elastic.co/t/scaling-logstash-nodes/259792 "2020-12-30T19:43:11Z")
Hello, We have oracle (single table) \>\> logstash \>\> elasticsearch. What is the way to scale horizontally logstash nodes to prevent the same data selection from the same source? (oracle table) --- ## [Disable "Add data" tab in kibana](https://discuss.elastic.co/t/disable-add-data-tab-in-kibana/259914)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 1\ **Last updated:** [December 30, 2020, 8:52pm UTC](https://discuss.elastic.co/t/disable-add-data-tab-in-kibana/259914 "2020-12-30T20:52:56Z")
I have user and associated roles with it. these users are only allowed to read some index and create visulization and dashboard. but on main screen it has "Add Data" which then shows what kind of logs and metric you ca… --- ## [Issue with too little memory, running several docker container (including Elasticsearch)](https://discuss.elastic.co/t/issue-with-too-little-memory-running-several-docker-container-including-elasticsearch/259913)
**Author:** [@lochr](https://discuss.elastic.co/u/lochr)\ **Replies:** 4\ **Last updated:** [December 30, 2020, 8:37pm UTC](https://discuss.elastic.co/t/issue-with-too-little-memory-running-several-docker-container-including-elasticsearch/259913 "2020-12-30T20:37:25Z")
Hello everyone, I have an issue with the environment variable discovery.type=single-node when spinning up an Elasticsearch container via docker-compose: Sample docker-compose file as follows: elasticsearch: … --- ## [Different results on same query once a document is updated](https://discuss.elastic.co/t/different-results-on-same-query-once-a-document-is-updated/259874)
**Author:** [@Gaurav\_Sharma2](https://discuss.elastic.co/u/Gaurav_Sharma2)\ **Replies:** 1\ **Last updated:** [December 30, 2020, 8:26pm UTC](https://discuss.elastic.co/t/different-results-on-same-query-once-a-document-is-updated/259874 "2020-12-30T20:26:43Z")
Hi, When I perform a search query, it gives me same result every time. But as soon as I update any document (fields which are not used in search query), the result of the same query changes and score of that particular … --- ## [Timelion cusum not working with log?](https://discuss.elastic.co/t/timelion-cusum-not-working-with-log/259645)
**Author:** [@georgeRD](https://discuss.elastic.co/u/georgeRD)\ **Replies:** 4\ **Last updated:** [December 30, 2020, 7:51pm UTC](https://discuss.elastic.co/t/timelion-cusum-not-working-with-log/259645 "2020-12-30T19:51:44Z")
I have created a graph in timelion that generates daily returns using data from an index that keeps the daily balance of an account. The code is the following: .es(index=daily\_account,q="account:1794",metric=sum:daily\_p… --- ## [Create bar visualization with count multiple boolean variables](https://discuss.elastic.co/t/create-bar-visualization-with-count-multiple-boolean-variables/259904)
**Author:** [@Joao\_Palma](https://discuss.elastic.co/u/Joao_Palma)\ **Replies:** 3\ **Last updated:** [December 30, 2020, 7:24pm UTC](https://discuss.elastic.co/t/create-bar-visualization-with-count-multiple-boolean-variables/259904 "2020-12-30T19:24:00Z")
Hello, I have an log like this: {"option1":"false", "option2":"true", "option3":"false"} {"option1":"true", "option2":"true", "option3":"false"} {"option1":"false", "option2":"true", "option3":"true"} ... And… --- ## [Difficulty displaying all hits in kibana](https://discuss.elastic.co/t/difficulty-displaying-all-hits-in-kibana/259790)
**Author:** [@Falikou1](https://discuss.elastic.co/u/Falikou1)\ **Replies:** 13\ **Last updated:** [December 30, 2020, 7:19pm UTC](https://discuss.elastic.co/t/difficulty-displaying-all-hits-in-kibana/259790 "2020-12-30T19:19:45Z")
Hello, I send the logs continuously to logstash. But, the logs are not displayed continuously in kibana. It shows me 8 hits over the last 7 days. While logs logs have been sent continuously for 7 days. Can you help m… --- ## [Querying a file path field by just the basename](https://discuss.elastic.co/t/querying-a-file-path-field-by-just-the-basename/257582)
**Author:** [@dansei](https://discuss.elastic.co/u/dansei)\ **Replies:** 6\ **Last updated:** [December 30, 2020, 7:02pm UTC](https://discuss.elastic.co/t/querying-a-file-path-field-by-just-the-basename/257582 "2020-12-30T19:02:25Z")
I have a field that stores the full path of a file on disk. The file's basename is unique and I'd like to be able to query for just the basename as well. The simplest solution is to add a second field which contains the… --- ## [Is it possible to remove unrelated y-axis value in visualization?](https://discuss.elastic.co/t/is-it-possible-to-remove-unrelated-y-axis-value-in-visualization/259818)
**Author:** [@jhagen92](https://discuss.elastic.co/u/jhagen92)\ **Replies:** 1\ **Last updated:** [December 30, 2020, 7:01pm UTC](https://discuss.elastic.co/t/is-it-possible-to-remove-unrelated-y-axis-value-in-visualization/259818 "2020-12-30T19:01:11Z")
Hi, I have a log coming in from different sources with exitCode. I created a heatmap to show how many exitCode happened in specific source. However, sometimes one of the source doesn't have some of the exitCode, but it… --- ## [Data Node Hardware Failure](https://discuss.elastic.co/t/data-node-hardware-failure/259887)
**Author:** [@jalaine](https://discuss.elastic.co/u/jalaine)\ **Replies:** 16\ **Last updated:** [December 30, 2020, 6:22pm UTC](https://discuss.elastic.co/t/data-node-hardware-failure/259887 "2020-12-30T18:22:58Z")
Hi there, Unfortunately, due to the circumstances of where I work I can't be to specific or share screen shots, but hopefully I can get you guys in the ballpark. We have a cluster that is made up of 7 data nodes (dell r… --- ## [Prioritise a "should" query](https://discuss.elastic.co/t/prioritise-a-should-query/259907)
**Author:** [@ivanibash](https://discuss.elastic.co/u/ivanibash)\ **Replies:** 0\ **Last updated:** [December 30, 2020, 6:19pm UTC](https://discuss.elastic.co/t/prioritise-a-should-query/259907 "2020-12-30T18:19:02Z")
I have a should query like query: { bool: { should: \[ { match: { name: value, } }, { … --- ## [Kibana "count by" in Alert monitor/trigger](https://discuss.elastic.co/t/kibana-count-by-in-alert-monitor-trigger/259757)
**Author:** [@biker2o](https://discuss.elastic.co/u/biker2o)\ **Replies:** 1\ **Last updated:** [December 30, 2020, 5:59pm UTC](https://discuss.elastic.co/t/kibana-count-by-in-alert-monitor-trigger/259757 "2020-12-30T17:59:10Z")
Hello. I am trying to figure out how to turn this Splunk alert into a kibana alert. Essentially, I want to be notified by Kibana when the count of ClientRequestHost is greater than 300 in a 1min period (or time span) for… --- ## [Help with installing elastic stack](https://discuss.elastic.co/t/help-with-installing-elastic-stack/259831)
**Author:** [@Grant1999](https://discuss.elastic.co/u/Grant1999)\ **Replies:** 2\ **Last updated:** [December 30, 2020, 5:32pm UTC](https://discuss.elastic.co/t/help-with-installing-elastic-stack/259831 "2020-12-30T17:32:10Z")
I have downloaded elastic search and kibana, extracted them both into a folder called elastic stack and when trying to run elastic search in the command prompt it comes up with this error. Any ideas how to resolve this?.… --- ## [Timelion query on nested field](https://discuss.elastic.co/t/timelion-query-on-nested-field/259396)
**Author:** [@fran6ssl](https://discuss.elastic.co/u/fran6ssl)\ **Replies:** 1\ **Last updated:** [December 30, 2020, 5:16pm UTC](https://discuss.elastic.co/t/timelion-query-on-nested-field/259396 "2020-12-30T17:16:33Z")
Hi, I have an index temple that defines a nested field as follows : "equipments": { "type": "nested", "properties": { "label": { "type": "keyword" }, … --- ## [How to create chart for User Growth Rate in kibana](https://discuss.elastic.co/t/how-to-create-chart-for-user-growth-rate-in-kibana/258692)
**Author:** [@dharanesh](https://discuss.elastic.co/u/dharanesh)\ **Replies:** 3\ **Last updated:** [December 30, 2020, 5:05pm UTC](https://discuss.elastic.co/t/how-to-create-chart-for-user-growth-rate-in-kibana/258692 "2020-12-30T17:05:12Z")
I have user logs i need to find user growth rate how to do this in kibana. --- ## [Filebeat index is getting created but with 0 documents](https://discuss.elastic.co/t/filebeat-index-is-getting-created-but-with-0-documents/259667)
**Author:** [@anujaggarwal](https://discuss.elastic.co/u/anujaggarwal)\ **Replies:** 2\ **Last updated:** [December 30, 2020, 4:49pm UTC](https://discuss.elastic.co/t/filebeat-index-is-getting-created-but-with-0-documents/259667 "2020-12-30T16:49:57Z")
Hi I am trying to index my custom log file using filebeat. I am successfully running filebeat with pre-built modules like mysql, nginx etc. But when I actually try to use it with my application specific log file, index … --- ## [Read actual and previous line using plugin file in Logstash](https://discuss.elastic.co/t/read-actual-and-previous-line-using-plugin-file-in-logstash/259823)
**Author:** [@dooger21](https://discuss.elastic.co/u/dooger21)\ **Replies:** 2\ **Last updated:** [December 30, 2020, 4:36pm UTC](https://discuss.elastic.co/t/read-actual-and-previous-line-using-plugin-file-in-logstash/259823 "2020-12-30T16:36:31Z")
Hello everyone, I need to read a log in tail mode and for each record read in real time to also obtain the previous record. That is, whatever you read the row (11) that has the date 20200607-00:10:00 also get the previo… --- ## [How can I include specific facet values in an aggregation?](https://discuss.elastic.co/t/how-can-i-include-specific-facet-values-in-an-aggregation/259819)
**Author:** [@Catalin](https://discuss.elastic.co/u/Catalin)\ **Replies:** 3\ **Last updated:** [December 30, 2020, 3:37pm UTC](https://discuss.elastic.co/t/how-can-i-include-specific-facet-values-in-an-aggregation/259819 "2020-12-30T15:37:20Z")
I have the following field and values for my documents: publication\_year : 2000, 2001, 2002, ..., 2020 I'd like to aggregate by publication\_year , return the top 5 buckets, but also add specific buckets to the result (… --- ## [Physical replication in Elasticsearch](https://discuss.elastic.co/t/physical-replication-in-elasticsearch/259886)
**Author:** [@itiyamas](https://discuss.elastic.co/u/itiyamas)\ **Replies:** 0\ **Last updated:** [December 30, 2020, 2:10pm UTC](https://discuss.elastic.co/t/physical-replication-in-elasticsearch/259886 "2020-12-30T14:10:59Z")
I know that this has been discussed earlier, but not all advantages were discussed in the earlier post. Also, the earlier discussion happened really long back and I would like to understand if you still feel that it does… --- ## [Multiple output options in logstash.conf](https://discuss.elastic.co/t/multiple-output-options-in-logstash-conf/259877)
**Author:** [@nyquillus](https://discuss.elastic.co/u/nyquillus)\ **Replies:** 8\ **Last updated:** [December 30, 2020, 1:45pm UTC](https://discuss.elastic.co/t/multiple-output-options-in-logstash-conf/259877 "2020-12-30T13:45:54Z")
Hi, I'm trying to come up with a logstash.conf to seperate the indexing method between 2 different sources. One will be daily index and other will be monthly index. I came up with something like this but it didn't work. … --- ## [How to intercept kibana request from ES to use only a subset of data](https://discuss.elastic.co/t/how-to-intercept-kibana-request-from-es-to-use-only-a-subset-of-data/259885)
**Author:** [@ranitg](https://discuss.elastic.co/u/ranitg)\ **Replies:** 1\ **Last updated:** [December 30, 2020, 2:04pm UTC](https://discuss.elastic.co/t/how-to-intercept-kibana-request-from-es-to-use-only-a-subset-of-data/259885 "2020-12-30T14:04:23Z")
Hi, I'm trying to intercept Kibana query to ES. I need for the Dashboards only to use a subset of documents as it's DATA. This can't be achieved as a dashboard filter. How can this be achieved? Do I need to intercept t… --- ## [Error from stock auditbeat dashboards](https://discuss.elastic.co/t/error-from-stock-auditbeat-dashboards/259485)
**Author:** [@ethrbunny](https://discuss.elastic.co/u/ethrbunny)\ **Replies:** 5\ **Last updated:** [December 30, 2020, 1:16pm UTC](https://discuss.elastic.co/t/error-from-stock-auditbeat-dashboards/259485 "2020-12-30T13:16:47Z")
I installed the 'stock' auditbeat dashboards for v7.10. Opening the 'System Overview ECS' I get this error on the majority of the panels: search\_phase\_execution\_exception Error: Bad Request at Fetch.\_callee3$ (http://10… --- ## [Logstash S3 Input Plugin not recognizing IAM Instance Profile](https://discuss.elastic.co/t/logstash-s3-input-plugin-not-recognizing-iam-instance-profile/259812)
**Author:** [@prod](https://discuss.elastic.co/u/prod)\ **Replies:** 2\ **Last updated:** [December 30, 2020, 12:47pm UTC](https://discuss.elastic.co/t/logstash-s3-input-plugin-not-recognizing-iam-instance-profile/259812 "2020-12-30T12:47:44Z")
Checking the S3 Input plugin documentation This plugin uses the AWS SDK and supports several ways to get credentials, which will be tried in this order: Static configuration, using access\_key\_id and secret\_access\_k… --- ## [Logstash grok field not found](https://discuss.elastic.co/t/logstash-grok-field-not-found/259864)
**Author:** [@abu.sayeed](https://discuss.elastic.co/u/abu.sayeed)\ **Replies:** 0\ **Last updated:** [December 30, 2020, 9:10am UTC](https://discuss.elastic.co/t/logstash-grok-field-not-found/259864 "2020-12-30T09:10:11Z")
Thanks all [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1622) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1624)