# Elastic Stack

**URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1634

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1635

---

## [\[OPENDISTRO - Elasticsearch\] Machine learning JOB System Requirements](https://discuss.elastic.co/t/opendistro-elasticsearch-machine-learning-job-system-requirements/259239)

<div class="topic-metadata">

**Author:** [@Flavio1](https://discuss.elastic.co/u/Flavio1)\
**Replies:** 1\
**Last updated:** [December 21, 2020, 11:14am UTC](https://discuss.elastic.co/t/opendistro-elasticsearch-machine-learning-job-system-requirements/259239 "2020-12-21T11:14:05Z")

</div>

Hi everybody, Is there any document or table with system requirements to implement elasticsearch opendistro machine learning jobs? Any help will be appreciated.

---

## [Kibana Dashboard for sales team](https://discuss.elastic.co/t/kibana-dashboard-for-sales-team/259052)

<div class="topic-metadata">

**Author:** [@bhavin.shah](https://discuss.elastic.co/u/bhavin.shah)\
**Replies:** 4\
**Last updated:** [December 21, 2020, 10:29am UTC](https://discuss.elastic.co/t/kibana-dashboard-for-sales-team/259052 "2020-12-21T10:29:17Z")

</div>

Hi team, I am relatively new on ES and Kibana and my business team needs very specific dashboard as mentioned in below snapshot. We can prepare state of the art dashboards into Kibana where I can get sense of business …

---

## [Search content in English and resultset returns in other languages](https://discuss.elastic.co/t/search-content-in-english-and-resultset-returns-in-other-languages/259070)

<div class="topic-metadata">

**Author:** [@Antonio\_Teixeira](https://discuss.elastic.co/u/Antonio_Teixeira)\
**Replies:** 2\
**Last updated:** [December 21, 2020, 10:26am UTC](https://discuss.elastic.co/t/search-content-in-english-and-resultset-returns-in-other-languages/259070 "2020-12-21T10:26:27Z")

</div>

Hello All Im trying to find the best way to receive in the resultset all the results that being made in a language plus the results in another language. For example if i search for black, i want that Elasticsearch retr…

---

## [JournalBeat Stopped Shipping Logs](https://discuss.elastic.co/t/journalbeat-stopped-shipping-logs/259195)

<div class="topic-metadata">

**Author:** [@vamshisiddarth](https://discuss.elastic.co/u/vamshisiddarth)\
**Replies:** 2\
**Last updated:** [December 21, 2020, 10:22am UTC](https://discuss.elastic.co/t/journalbeat-stopped-shipping-logs/259195 "2020-12-21T10:22:22Z")

</div>

JournalBeat stopped shipping logs on all environments for us from 19th Dec, 2020. We configured our beats services to ship logs from aws instance to elasticsearch through logstash. Our filebeat and metricbeat logs are be…

---

## [Kibana anonymous authentication error](https://discuss.elastic.co/t/kibana-anonymous-authentication-error/259159)

<div class="topic-metadata">

**Author:** [@Valerioq](https://discuss.elastic.co/u/Valerioq)\
**Replies:** 2\
**Last updated:** [December 21, 2020, 10:16am UTC](https://discuss.elastic.co/t/kibana-anonymous-authentication-error/259159 "2020-12-21T10:16:50Z")

</div>

Hi, I tried to set anonymous authentication on kibana ver 7.8 following these instructions: But when I insert in my kibana.yml: xpack.security. authc.providers: basic.basic1: order: 0 anonymous.anonymous1: ord…

---

## [How to Reconfigure the setup-password for the elastic cluster, as we are getting the authentication error for all the users](https://discuss.elastic.co/t/how-to-reconfigure-the-setup-password-for-the-elastic-cluster-as-we-are-getting-the-authentication-error-for-all-the-users/259219)

<div class="topic-metadata">

**Author:** [@KunwarAkanksha](https://discuss.elastic.co/u/KunwarAkanksha)\
**Replies:** 1\
**Last updated:** [December 21, 2020, 9:57am UTC](https://discuss.elastic.co/t/how-to-reconfigure-the-setup-password-for-the-elastic-cluster-as-we-are-getting-the-authentication-error-for-all-the-users/259219 "2020-12-21T09:57:57Z")

</div>

Enabling xpack.security.enabled to true alone was not enough to start the elasticsearch, as it was giving the error, so we have generated the certificates and deployed it to all the nodes of elastic cluster and kibana us…

---

## [How to config filebeat to collect containerd logs file in K8S?](https://discuss.elastic.co/t/how-to-config-filebeat-to-collect-containerd-logs-file-in-k8s/259237)

<div class="topic-metadata">

**Author:** [@hillbun](https://discuss.elastic.co/u/hillbun)\
**Replies:** 0\
**Last updated:** [December 21, 2020, 9:53am UTC](https://discuss.elastic.co/t/how-to-config-filebeat-to-collect-containerd-logs-file-in-k8s/259237 "2020-12-21T09:53:36Z")

</div>

apiVersion: v1 kind: ConfigMap metadata: name: filebeat-inputs namespace: kube-system labels: k8s-app: filebeat data: kubernetes.yml: |- - type: container symlinks: true paths: - '/var/log/containers/\*.log' …

---

## [Timelion query detecting value change](https://discuss.elastic.co/t/timelion-query-detecting-value-change/259236)

<div class="topic-metadata">

**Author:** [@fran6ssl](https://discuss.elastic.co/u/fran6ssl)\
**Replies:** 0\
**Last updated:** [December 21, 2020, 9:49am UTC](https://discuss.elastic.co/t/timelion-query-detecting-value-change/259236 "2020-12-21T09:49:35Z")

</div>

Hi, I am using Timelion with a time serie where I need to show occurences when a value changed from X to Y. E.g I have a boolean property and I want to write a timelion query that shows when the value changed from True…

---

## [User Specific Configurable Dashboards](https://discuss.elastic.co/t/user-specific-configurable-dashboards/259229)

<div class="topic-metadata">

**Author:** [@RamyaGowda](https://discuss.elastic.co/u/RamyaGowda)\
**Replies:** 3\
**Last updated:** [December 21, 2020, 9:27am UTC](https://discuss.elastic.co/t/user-specific-configurable-dashboards/259229 "2020-12-21T09:27:06Z")

</div>

Hi Team, I know that if user has write/admin access he/she can edit dashboard Add objects, Remove objects , Apply Filters, Apply Search Queries. But can this be user specific? if user "xyz" make any changes this shoul…

---

## [Shard allocation based on shard size](https://discuss.elastic.co/t/shard-allocation-based-on-shard-size/257817)

<div class="topic-metadata">

**Author:** [@coudenysj](https://discuss.elastic.co/u/coudenysj)\
**Replies:** 13\
**Last updated:** [December 21, 2020, 8:38am UTC](https://discuss.elastic.co/t/shard-allocation-based-on-shard-size/257817 "2020-12-21T08:38:30Z")

</div>

Hi, I was wondering if there is an option to include shard size in the shard allocation decision process. The Disk-based shard allocation settings and the number of shards/node works, and most of or shards are 50G in s…

---

## [Snapshots - restoring an index from a large repository with long term storage (LTO ...)](https://discuss.elastic.co/t/snapshots-restoring-an-index-from-a-large-repository-with-long-term-storage-lto/259198)

<div class="topic-metadata">

**Author:** [@Rysiu](https://discuss.elastic.co/u/Rysiu)\
**Replies:** 3\
**Last updated:** [December 21, 2020, 8:18am UTC](https://discuss.elastic.co/t/snapshots-restoring-an-index-from-a-large-repository-with-long-term-storage-lto/259198 "2020-12-21T08:18:36Z")

</div>

I have a classic question about snapshots in elasticsearch. I make elasticsearch snapshots to some repository - for example, let it be some Network File System (NFS) or similar. Later this snapshot from this network st…

---

## [Restoring deleted elasticsearch indices](https://discuss.elastic.co/t/restoring-deleted-elasticsearch-indices/259017)

<div class="topic-metadata">

**Author:** [@abi.mc](https://discuss.elastic.co/u/abi.mc)\
**Replies:** 4\
**Last updated:** [December 21, 2020, 7:44am UTC](https://discuss.elastic.co/t/restoring-deleted-elasticsearch-indices/259017 "2020-12-21T07:44:20Z")

</div>

In kibana (two node cluster ) following indices got deleted from the file system and now kibana is not accessible : bxexbuIpRXqA0n4VyXiDQA - .security-7 3R2woj\_jRVCf58Q8b9--Yg - .apm-agent-configuration RGR9AneMRx6nnQGH…

---

## [Handling custom exception serialisation for plugins](https://discuss.elastic.co/t/handling-custom-exception-serialisation-for-plugins/259225)

<div class="topic-metadata">

**Author:** [@Bukhtawar\_Khan](https://discuss.elastic.co/u/Bukhtawar_Khan)\
**Replies:** 0\
**Last updated:** [December 21, 2020, 7:37am UTC](https://discuss.elastic.co/t/handling-custom-exception-serialisation-for-plugins/259225 "2020-12-21T07:37:29Z")

</div>

The wire serialization of exceptions require exceptions to be registered. For instance if the transport node(transport inter-node communication) throws a custom exception, the caller node at transport needs to handle thi…

---

## [Logstash data type change in config file](https://discuss.elastic.co/t/logstash-data-type-change-in-config-file/258680)

<div class="topic-metadata">

**Author:** [@anjali28](https://discuss.elastic.co/u/anjali28)\
**Replies:** 3\
**Last updated:** [December 21, 2020, 7:19am UTC](https://discuss.elastic.co/t/logstash-data-type-change-in-config-file/258680 "2020-12-21T07:19:18Z")

</div>

Hello i am creating a config file to import the data from a csv file. when i call the config file as it is, its working properly and data is coming in kibana. But when i am changing the data type of a field in logstas…

---

## [Es update document very slow](https://discuss.elastic.co/t/es-update-document-very-slow/259072)

<div class="topic-metadata">

**Author:** [@111421](https://discuss.elastic.co/u/111421)\
**Replies:** 10\
**Last updated:** [December 21, 2020, 7:09am UTC](https://discuss.elastic.co/t/es-update-document-very-slow/259072 "2020-12-21T07:09:27Z")

</div>

Now it even takes about 7 minutes to update a doc. Single node, heap size: 8G, 30 shards, a total of 6.2G data, 2 million doc. This is too slow, if anyone can tell me how to solve it, I would appreciate it iostat Lin…

---

## [Cluster Health RED unassigned primary and replica shards](https://discuss.elastic.co/t/cluster-health-red-unassigned-primary-and-replica-shards/258891)

<div class="topic-metadata">

**Author:** [@RusseL](https://discuss.elastic.co/u/RusseL)\
**Replies:** 2\
**Last updated:** [December 21, 2020, 7:08am UTC](https://discuss.elastic.co/t/cluster-health-red-unassigned-primary-and-replica-shards/258891 "2020-12-21T07:08:54Z")

</div>

Hello to everyone, Cluster health turned red when a node fell from the cluster. When I re-add the node, some directories automatically turned from red to green, but there is an index still red and I don't know what to d…

---

## [Filter Plugin - "Tried to load a plugin's code, but failed."](https://discuss.elastic.co/t/filter-plugin-tried-to-load-a-plugins-code-but-failed/259216)

<div class="topic-metadata">

**Author:** [@smm](https://discuss.elastic.co/u/smm)\
**Replies:** 1\
**Last updated:** [December 21, 2020, 6:34am UTC](https://discuss.elastic.co/t/filter-plugin-tried-to-load-a-plugins-code-but-failed/259216 "2020-12-21T06:34:57Z")

</div>

Hi there, there is a logstash filter plugin called elapsed. I put (also) this into a config: elapsed { unique\_id\_field =\> "reqid" start\_tag =\> "TranBegin" end\_tag =\> "TranEnd" new\_event\_on\_match =\> false } a…

---

## [Why can't receive log from the ftp server?](https://discuss.elastic.co/t/why-cant-receive-log-from-the-ftp-server/259217)

<div class="topic-metadata">

**Author:** [@111418](https://discuss.elastic.co/u/111418)\
**Replies:** 0\
**Last updated:** [December 21, 2020, 6:14am UTC](https://discuss.elastic.co/t/why-cant-receive-log-from-the-ftp-server/259217 "2020-12-21T06:14:20Z")

</div>

My conf is input { tcp { port =\> 10514 type=\> "leo\_ftp" } tcp { port =\> 10515 type =\> "jim\_ftp" } } filter { } output { if\[type\]=="leo\_ftp"{ elasticsearch { hosts =\> \["ip:9200"\] inde…

---

## [HAProxy + Logstash](https://discuss.elastic.co/t/haproxy-logstash/259215)

<div class="topic-metadata">

**Author:** [@Gigazo1d](https://discuss.elastic.co/u/Gigazo1d)\
**Replies:** 0\
**Last updated:** [December 21, 2020, 6:04am UTC](https://discuss.elastic.co/t/haproxy-logstash/259215 "2020-12-21T06:04:45Z")

</div>

Hi! I plan to use HAProxy + Logstash to receive events and send them to another syslog server. Could you please share examples of your HAProxy config for my view.

---

## [Reading environment variables set with exec plugin](https://discuss.elastic.co/t/reading-environment-variables-set-with-exec-plugin/259189)

<div class="topic-metadata">

**Author:** [@Lukasz\_Geras](https://discuss.elastic.co/u/Lukasz_Geras)\
**Replies:** 4\
**Last updated:** [December 21, 2020, 5:56am UTC](https://discuss.elastic.co/t/reading-environment-variables-set-with-exec-plugin/259189 "2020-12-21T05:56:59Z")

</div>

Hello, could you please help me with reading environment variables set with exec plugin in logstash. Generally, my input looks like this: input{ exec{ command=\> „export FILENAME=$(ls -Arst /path/to/…

---

## [FileBeat/Modules for SNMP Trap](https://discuss.elastic.co/t/filebeat-modules-for-snmp-trap/259214)

<div class="topic-metadata">

**Author:** [@sreekeshava\_srihari](https://discuss.elastic.co/u/sreekeshava_srihari)\
**Replies:** 0\
**Last updated:** [December 21, 2020, 5:41am UTC](https://discuss.elastic.co/t/filebeat-modules-for-snmp-trap/259214 "2020-12-21T05:41:41Z")

</div>

Hi All Does Elastic Beats/Modules provide to consume SNMP Traps so that Logstash can be avoided to consume SNMP Traps. Thanks in Advance Sreekeshava S

---

## [Logstash is picking messages quiet slowly](https://discuss.elastic.co/t/logstash-is-picking-messages-quiet-slowly/259160)

<div class="topic-metadata">

**Author:** [@rohitarorait82](https://discuss.elastic.co/u/rohitarorait82)\
**Replies:** 2\
**Last updated:** [December 21, 2020, 5:02am UTC](https://discuss.elastic.co/t/logstash-is-picking-messages-quiet-slowly/259160 "2020-12-21T05:02:28Z")

</div>

Hi All, We have traffic around 100 million records per day and it was working fine till yesterday , but today I can see 50 million records are piled up at the the source system . i have tried increasing pipeline.workers…

---

## [Is this an error in documentation of "numeric\_detection"](https://discuss.elastic.co/t/is-this-an-error-in-documentation-of-numeric-detection/258944)

<div class="topic-metadata">

**Author:** [@pk.241011](https://discuss.elastic.co/u/pk.241011)\
**Replies:** 5\
**Last updated:** [December 21, 2020, 4:50am UTC](https://discuss.elastic.co/t/is-this-an-error-in-documentation-of-numeric-detection/258944 "2020-12-21T04:50:57Z")

</div>

Hi, I was going through the documentation of Dynamic Field Mapping. In the table I see the last entry: JSON data type.......................................Elasticsearch data type string..............................…

---

## [Filebeat dashboards are not loaded in kibana - Running on AWS](https://discuss.elastic.co/t/filebeat-dashboards-are-not-loaded-in-kibana-running-on-aws/259204)

<div class="topic-metadata">

**Author:** [@ats](https://discuss.elastic.co/u/ats)\
**Replies:** 3\
**Last updated:** [December 21, 2020, 3:31am UTC](https://discuss.elastic.co/t/filebeat-dashboards-are-not-loaded-in-kibana-running-on-aws/259204 "2020-12-21T03:31:57Z")

</div>

I am running 3 nodes in AWS: 1 master and 2 data nodes for Elasticsearch. I installed kibana fine with no issues. Now I'm running into an issue with setting up filebeat dashboard in Kibana. Getting the following error ro…

---

## [Kibana queries time out for some directories](https://discuss.elastic.co/t/kibana-queries-time-out-for-some-directories/258684)

<div class="topic-metadata">

**Author:** [@RusseL](https://discuss.elastic.co/u/RusseL)\
**Replies:** 1\
**Last updated:** [December 21, 2020, 3:29am UTC](https://discuss.elastic.co/t/kibana-queries-time-out-for-some-directories/258684 "2020-12-21T03:29:20Z")

</div>

Kibana queries timed out for some directories. Stack Tracking is not working. I know that when I only query on one directory, the query times out. I have 12 nodes(9 data - 3 master). kibana 7.4.2 elasticsearch 7.4.2

---

## [How to monitor/identify retry result with output elasticsearch](https://discuss.elastic.co/t/how-to-monitor-identify-retry-result-with-output-elasticsearch/258681)

<div class="topic-metadata">

**Author:** [@loker](https://discuss.elastic.co/u/loker)\
**Replies:** 0\
**Last updated:** [December 15, 2020, 8:28am UTC](https://discuss.elastic.co/t/how-to-monitor-identify-retry-result-with-output-elasticsearch/258681 "2020-12-15T08:28:00Z")

</div>

Hello there, Recently i meet some warning about es reject caused by queue exceed 200 limit. According to its retry policy for es output plugin, it should retry indefinitely for this kind of error(429). But i don't kno…

---

## [Getting MasterNotDiscoveredException: null in client nodes](https://discuss.elastic.co/t/getting-masternotdiscoveredexception-null-in-client-nodes/258699)

<div class="topic-metadata">

**Author:** [@nchalise](https://discuss.elastic.co/u/nchalise)\
**Replies:** 1\
**Last updated:** [December 21, 2020, 3:23am UTC](https://discuss.elastic.co/t/getting-masternotdiscoveredexception-null-in-client-nodes/258699 "2020-12-21T03:23:43Z")

</div>

We have 3 master nodes, 2 client nodes, and 8 data nodes. And client nodes ES logs show below mentioned error even though resource usage(JVM and CPU ) looks fine at that time. And cluster went unresponsive mode. ALL node…

---

## [How to store service account file into embedded ES keystore?](https://discuss.elastic.co/t/how-to-store-service-account-file-into-embedded-es-keystore/258956)

<div class="topic-metadata">

**Author:** [@balakrishnan](https://discuss.elastic.co/u/balakrishnan)\
**Replies:** 1\
**Last updated:** [December 21, 2020, 3:13am UTC](https://discuss.elastic.co/t/how-to-store-service-account-file-into-embedded-es-keystore/258956 "2020-12-21T03:13:14Z")

</div>

We are using embedded ES (version 5.6) and am exploring the snapshot & restore options with GCS as snapshot repository. The repository-gcs plugin expects that the service account JSON file must be added into the elastics…

---

## [Print Count of any particular field in watcher email body along with total Payload](https://discuss.elastic.co/t/print-count-of-any-particular-field-in-watcher-email-body-along-with-total-payload/259170)

<div class="topic-metadata">

**Author:** [@Sajal](https://discuss.elastic.co/u/Sajal)\
**Replies:** 0\
**Last updated:** [December 19, 2020, 5:04pm UTC](https://discuss.elastic.co/t/print-count-of-any-particular-field-in-watcher-email-body-along-with-total-payload/259170 "2020-12-19T17:04:19Z")

</div>

Hi Folks , I am able to get ctx.payload.hits.total in an index but i want to print count of any particular feild(like how many channel session ID occured in an index) in watcher email body. How should i get that ? Than…

---

## [Visual C++ Redistributable error](https://discuss.elastic.co/t/visual-c-redistributable-error/259210)

<div class="topic-metadata">

**Author:** [@nameisnotimportant](https://discuss.elastic.co/u/nameisnotimportant)\
**Replies:** 0\
**Last updated:** [December 21, 2020, 2:35am UTC](https://discuss.elastic.co/t/visual-c-redistributable-error/259210 "2020-12-21T02:35:46Z")

</div>

Trying to install the ODBC driver but the esodbc driver keeps asking for Visual C++ 2017 Redistributable, which, i already installed. Any idea wheat is wrong ?

[Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1633)

[Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1635)
