# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1641 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1642 --- ## [Logstash pipelines taking longer duration to start](https://discuss.elastic.co/t/logstash-pipelines-taking-longer-duration-to-start/258776)
**Author:** [@Sreekanth3](https://discuss.elastic.co/u/Sreekanth3)\ **Replies:** 2\ **Last updated:** [December 16, 2020, 11:38am UTC](https://discuss.elastic.co/t/logstash-pipelines-taking-longer-duration-to-start/258776 "2020-12-16T11:38:03Z")
Hi all, I am using a logstash with 8 pipelines and if restart the logstash it is taking around 45 minutes to get started and bound to 9600 port. The logstash version is 7.7.0 . I'm looking to optimize the logstash to … --- ## [Recover index from ../nodes/0/indices/ to new cluster](https://discuss.elastic.co/t/recover-index-from-nodes-0-indices-to-new-cluster/258836)
**Author:** [@heikis](https://discuss.elastic.co/u/heikis)\ **Replies:** 2\ **Last updated:** [December 16, 2020, 11:10am UTC](https://discuss.elastic.co/t/recover-index-from-nodes-0-indices-to-new-cluster/258836 "2020-12-16T11:10:15Z")
Hello. How complicated is it to recover an index that exists in ../nodes/0/indices/ ? For example I have the index data but the cluster that the index was related to is gone? Could I create a new cluster and reindex the… --- ## [Logstash is not working - mutate,remove\_field](https://discuss.elastic.co/t/logstash-is-not-working-mutate-remove-field/258852)
**Author:** [@KyungJin\_Joo](https://discuss.elastic.co/u/KyungJin_Joo)\ **Replies:** 0\ **Last updated:** [December 16, 2020, 11:10am UTC](https://discuss.elastic.co/t/logstash-is-not-working-mutate-remove-field/258852 "2020-12-16T11:10:59Z")
winlogbeat-my computer logstash-(GCP Compute Engine) Winlogbeat sends sysmon field from logstash. Filtering is as follows, It was written in a format that maps the ProcessCreate event. However, writing this way work… --- ## [Filebeat not sending logs anymore](https://discuss.elastic.co/t/filebeat-not-sending-logs-anymore/257246)
**Author:** [@toms130](https://discuss.elastic.co/u/toms130)\ **Replies:** 1\ **Last updated:** [December 16, 2020, 10:56am UTC](https://discuss.elastic.co/t/filebeat-not-sending-logs-anymore/257246 "2020-12-16T10:56:55Z")
Hi there, I've gor problem with a filebeat instance which ends to stop sending logs after smome time. Here is my setup : type: log enabled: true paths: - /opt/TalendRemoteEngine/TalendJobServersFiles/jobexecu… --- ## [Metricbeat AWS Module estimated costs](https://discuss.elastic.co/t/metricbeat-aws-module-estimated-costs/257863)
**Author:** [@Jurilz](https://discuss.elastic.co/u/Jurilz)\ **Replies:** 2\ **Last updated:** [December 16, 2020, 10:43am UTC](https://discuss.elastic.co/t/metricbeat-aws-module-estimated-costs/257863 "2020-12-16T10:43:53Z")
Good day, I'm thinking about the using metricbeats AWS module to collect and display metrics of one or several EC2 instances. And therefore I have to estimate the costs of AWS charges on CloudWatch API requests. Let's … --- ## [How to do match multiple nested object in one document with inner hits highlighted in elasticsearch](https://discuss.elastic.co/t/how-to-do-match-multiple-nested-object-in-one-document-with-inner-hits-highlighted-in-elasticsearch/258842)
**Author:** [@Code\_Wizard](https://discuss.elastic.co/u/Code_Wizard)\ **Replies:** 0\ **Last updated:** [December 16, 2020, 10:42am UTC](https://discuss.elastic.co/t/how-to-do-match-multiple-nested-object-in-one-document-with-inner-hits-highlighted-in-elasticsearch/258842 "2020-12-16T10:42:07Z")
How do I write a query with two search terms which matches nested objects with inner hits highlighted. Below is the sample usecase: I have a mapping: "mappings": { "properties": { "grocery\_name": { … --- ## [Chain of nodes - api call](https://discuss.elastic.co/t/chain-of-nodes-api-call/258804)
**Author:** [@smm](https://discuss.elastic.co/u/smm)\ **Replies:** 2\ **Last updated:** [December 16, 2020, 10:40am UTC](https://discuss.elastic.co/t/chain-of-nodes-api-call/258804 "2020-12-16T10:40:24Z")
Hi there, can someone give me an insight: If in Kibana I make a search, this query is transformed in a elasticsearch API call. My cluster has dedicated data nodes, dedicated master nodes, dedicated ingest nodes and ded… --- ## [Filter by ID without providing ID (turn 2 queries into one)](https://discuss.elastic.co/t/filter-by-id-without-providing-id-turn-2-queries-into-one/258837)
**Author:** [@mekanix](https://discuss.elastic.co/u/mekanix)\ **Replies:** 1\ **Last updated:** [December 16, 2020, 10:36am UTC](https://discuss.elastic.co/t/filter-by-id-without-providing-id-turn-2-queries-into-one/258837 "2020-12-16T10:36:08Z")
My problem can be distilled and exemplified by these 4 documents: { "\_id": 1, "owner": "A", "distance": 1, "age": 2 }, { "\_id": 2, "owner": "A", "distance": 2, "age": 1 }, { "\_id": 3,… --- ## [Winlogbeat service failing to start](https://discuss.elastic.co/t/winlogbeat-service-failing-to-start/258414)
**Author:** [@Craig2188](https://discuss.elastic.co/u/Craig2188)\ **Replies:** 2\ **Last updated:** [December 16, 2020, 10:13am UTC](https://discuss.elastic.co/t/winlogbeat-service-failing-to-start/258414 "2020-12-16T10:13:26Z")
Hi, I have installed Winlogbeat 7.9.2 onto a 2008 32bit server via the ps1 file. I go to start the service and get the following error: The winlogbeat service failed to start due to the following error: winlogbeat is … --- ## [Plot different index on the same](https://discuss.elastic.co/t/plot-different-index-on-the-same/258789)
**Author:** [@Ettore\_Ciarcia](https://discuss.elastic.co/u/Ettore_Ciarcia)\ **Replies:** 2\ **Last updated:** [December 16, 2020, 10:02am UTC](https://discuss.elastic.co/t/plot-different-index-on-the-same/258789 "2020-12-16T10:02:45Z")
Hello everyone! Here I am with another question I am trying to plot two different indices on the same chart. The first api- \* call contains the weather data collected via API. In the second call sensor- \* there are tho… --- ## [Trouble to write a query making two counts on a relative period of time and dividing the counts](https://discuss.elastic.co/t/trouble-to-write-a-query-making-two-counts-on-a-relative-period-of-time-and-dividing-the-counts/258827)
**Author:** [@Cedric\_Remond](https://discuss.elastic.co/u/Cedric_Remond)\ **Replies:** 0\ **Last updated:** [December 16, 2020, 9:14am UTC](https://discuss.elastic.co/t/trouble-to-write-a-query-making-two-counts-on-a-relative-period-of-time-and-dividing-the-counts/258827 "2020-12-16T09:14:03Z")
I have been trying to write a query for a few days now, and I began to worry it won't be possible. My goal is two make two counts (full-text queries) over a relative period of time (ie the last 24 hours), and my final r… --- ## [Possible to change mapping of field in datastream from text to float](https://discuss.elastic.co/t/possible-to-change-mapping-of-field-in-datastream-from-text-to-float/258834)
**Author:** [@hugohendriks](https://discuss.elastic.co/u/hugohendriks)\ **Replies:** 0\ **Last updated:** [December 16, 2020, 9:58am UTC](https://discuss.elastic.co/t/possible-to-change-mapping-of-field-in-datastream-from-text-to-float/258834 "2020-12-16T09:58:06Z")
hi, I have created a datastream and pushing data into it for a while. Recently I started filling a field which was original created as a text but the data are all floats. Can I change the mapping of the string field in … --- ## [Filebeat not able to send all logs](https://discuss.elastic.co/t/filebeat-not-able-to-send-all-logs/257930)
**Author:** [@user2416](https://discuss.elastic.co/u/user2416)\ **Replies:** 11\ **Last updated:** [December 16, 2020, 9:47am UTC](https://discuss.elastic.co/t/filebeat-not-able-to-send-all-logs/257930 "2020-12-16T09:47:12Z")
Hi, We are using filebeat as a deamonset on kubernetes nodes to collect all application logs and sending them to logstash and then to elasticsearch. In our Prod environment, we have some pods writing huge volume of eve… --- ## [Error adding nodes to the cluster = Master not discovered yet: have discovered](https://discuss.elastic.co/t/error-adding-nodes-to-the-cluster-master-not-discovered-yet-have-discovered/258815)
**Author:** [@RusseL](https://discuss.elastic.co/u/RusseL)\ **Replies:** 0\ **Last updated:** [December 16, 2020, 8:04am UTC](https://discuss.elastic.co/t/error-adding-nodes-to-the-cluster-master-not-discovered-yet-have-discovered/258815 "2020-12-16T08:04:00Z")
Hi everyone, I am trying to re-add a node that I previously removed from the cluster to the cluster. But I am getting this error. Checking in Elasticsearch.yml file but no problem. \[2020-12-16T10:20:28,770\]\[WARN \]… --- ## [Icons not showing in the table upon rendering](https://discuss.elastic.co/t/icons-not-showing-in-the-table-upon-rendering/258734)
**Author:** [@inhinyera16](https://discuss.elastic.co/u/inhinyera16)\ **Replies:** 1\ **Last updated:** [December 16, 2020, 9:42am UTC](https://discuss.elastic.co/t/icons-not-showing-in-the-table-upon-rendering/258734 "2020-12-16T09:42:48Z")
I created a URL script (image) which generates a link for the image to render based on the value of equivalent status field, say up or down. For example, if field value is up, then return green-color-icon url At first,… --- ## [Index Helath stay red over 1hour when restore snapshot](https://discuss.elastic.co/t/index-helath-stay-red-over-1hour-when-restore-snapshot/258558)
**Author:** [@fujitalon](https://discuss.elastic.co/u/fujitalon)\ **Replies:** 8\ **Last updated:** [December 16, 2020, 9:25am UTC](https://discuss.elastic.co/t/index-helath-stay-red-over-1hour-when-restore-snapshot/258558 "2020-12-16T09:25:15Z")
I have 2 ElasticCloud on Azure japaneast and southeastasia. Try to test failover, I want make snapshot on japaneast, then restore on southeastasia. I know direct restore didn't support between regions, So I make script… --- ## [Error in visualization \[lens\_merge\_tables\] \> \[esaggs\] \> Cannot read property 'aggConfig' of undefined](https://discuss.elastic.co/t/error-in-visualization-lens-merge-tables-esaggs-cannot-read-property-aggconfig-of-undefined/258544)
**Author:** [@zhirong\_tong](https://discuss.elastic.co/u/zhirong_tong)\ **Replies:** 8\ **Last updated:** [December 16, 2020, 9:12am UTC](https://discuss.elastic.co/t/error-in-visualization-lens-merge-tables-esaggs-cannot-read-property-aggconfig-of-undefined/258544 "2020-12-16T09:12:52Z")
Hi all, I am using ELK 7.5, facing an issue with the Lens in visualization, that is "\[lens\_merge\_tables\] \> \[esaggs\] \> Cannot read property 'aggConfig' of undefined", it happens when I drag fields into the panel of Lens… --- ## [Filebeats processor active not right under specific input](https://discuss.elastic.co/t/filebeats-processor-active-not-right-under-specific-input/258816)
**Author:** [@dukeyang](https://discuss.elastic.co/u/dukeyang)\ **Replies:** 0\ **Last updated:** [December 16, 2020, 8:16am UTC](https://discuss.elastic.co/t/filebeats-processor-active-not-right-under-specific-input/258816 "2020-12-16T08:16:07Z")
In the official doc, it says: Processors are valid: At the top-level in the configuration. The processor is applied to all data collected by Filebeat. Under a specific input. The processor is applied to the data colle… --- ## [Separate Filebeat container vs Filebeat on every container architectural decision](https://discuss.elastic.co/t/separate-filebeat-container-vs-filebeat-on-every-container-architectural-decision/258557)
**Author:** [@thanastasiadis](https://discuss.elastic.co/u/thanastasiadis)\ **Replies:** 1\ **Last updated:** [December 16, 2020, 9:10am UTC](https://discuss.elastic.co/t/separate-filebeat-container-vs-filebeat-on-every-container-architectural-decision/258557 "2020-12-16T09:10:38Z")
In a micro-service architecture, I am trying to decide between the two architectures: Installing file beat on every container Run a separate file beat container The official documentation suggests to install filebeat … --- ## [Why kubernetes' statefulset didn't run evenly for 3 pods?](https://discuss.elastic.co/t/why-kubernetes-statefulset-didnt-run-evenly-for-3-pods/258797)
**Author:** [@iooi](https://discuss.elastic.co/u/iooi)\ **Replies:** 2\ **Last updated:** [December 16, 2020, 8:43am UTC](https://discuss.elastic.co/t/why-kubernetes-statefulset-didnt-run-evenly-for-3-pods/258797 "2020-12-16T08:43:56Z")
I deployed a logstash by statefulset kind with 3 replicas in k8s. Using filebeat to send data to it. --- apiVersion: apps/v1 kind: StatefulSet metadata: name: logstash-nginx spec: serviceName: "logstash" selector:… --- ## [Kibana: Can not load data](https://discuss.elastic.co/t/kibana-can-not-load-data/258554)
**Author:** [@Phong\_Nguyen\_Dinh](https://discuss.elastic.co/u/Phong_Nguyen_Dinh)\ **Replies:** 4\ **Last updated:** [December 16, 2020, 8:33am UTC](https://discuss.elastic.co/t/kibana-can-not-load-data/258554 "2020-12-16T08:33:40Z")
I can not load the data in the Kibana table whenever my data contains a date format column I'm using the latest version of ELK Please kindly help me to resolve this issue Thanks so much --- ## [How to use json logs and also multiline together](https://discuss.elastic.co/t/how-to-use-json-logs-and-also-multiline-together/258347)
**Author:** [@user2416](https://discuss.elastic.co/u/user2416)\ **Replies:** 3\ **Last updated:** [December 16, 2020, 8:33am UTC](https://discuss.elastic.co/t/how-to-use-json-logs-and-also-multiline-together/258347 "2020-12-16T08:33:03Z")
Hi, We are using multiline pattern in filebeat but we also have Json logs which doesnt match that multiline pattern. We are seeing both multiline logs and json logs but some json logs are missing and also json logs are … --- ## [Index .kibana\_1 already exists during startup(7.7.0)](https://discuss.elastic.co/t/index-kibana-1-already-exists-during-startup-7-7-0/258549)
**Author:** [@zj27](https://discuss.elastic.co/u/zj27)\ **Replies:** 3\ **Last updated:** [December 16, 2020, 8:30am UTC](https://discuss.elastic.co/t/index-kibana-1-already-exists-during-startup-7-7-0/258549 "2020-12-16T08:30:56Z")
Hi when I first start the Kibana on a clean environment, sometimes it will fail with error "Index .kibana\_1 already exists ". I checked the log and code, then noticed the the .kibana\_1 was created but took too long time … --- ## [XPack Security Enabled TLS/SSL configured, still not working!](https://discuss.elastic.co/t/xpack-security-enabled-tls-ssl-configured-still-not-working/258716)
**Author:** [@S3l3ct3d](https://discuss.elastic.co/u/S3l3ct3d)\ **Replies:** 4\ **Last updated:** [December 16, 2020, 4:11am UTC](https://discuss.elastic.co/t/xpack-security-enabled-tls-ssl-configured-still-not-working/258716 "2020-12-16T04:11:41Z")
Good morning, We are putting ELK through a POC and have configure and 5 node cluster in the MS Azure space. Currently we have 3 ES nodes, 1 Kibana node and 1 Logstash node. I have been trying to work on getting the xpack… --- ## [Trouble querying for exact date with range query](https://discuss.elastic.co/t/trouble-querying-for-exact-date-with-range-query/258750)
**Author:** [@Matthew\_Ehinger](https://discuss.elastic.co/u/Matthew_Ehinger)\ **Replies:** 1\ **Last updated:** [December 16, 2020, 4:05am UTC](https://discuss.elastic.co/t/trouble-querying-for-exact-date-with-range-query/258750 "2020-12-16T04:05:41Z")
Hello, I have the following mapping definition in my events index: { "events": { "mappings": { "properties": { "data": { "properties": { "reportDate": { "type": "d… --- ## [Additional filters in Canvas](https://discuss.elastic.co/t/additional-filters-in-canvas/257711)
**Author:** [@Treki](https://discuss.elastic.co/u/Treki)\ **Replies:** 2\ **Last updated:** [December 16, 2020, 3:46am UTC](https://discuss.elastic.co/t/additional-filters-in-canvas/257711 "2020-12-16T03:46:30Z")
Hello everybody, We have created a canvas with several “dropdown select” as well as “data table” elements. The “dropdown select” elements are working as filters for the details presented in the “data table” elements. O… --- ## [Is there any way to validate other APIs like create index or update\_by\_query before executing it?](https://discuss.elastic.co/t/is-there-any-way-to-validate-other-apis-like-create-index-or-update-by-query-before-executing-it/258539)
**Author:** [@Graywd](https://discuss.elastic.co/u/Graywd)\ **Replies:** 2\ **Last updated:** [December 16, 2020, 2:36am UTC](https://discuss.elastic.co/t/is-there-any-way-to-validate-other-apis-like-create-index-or-update-by-query-before-executing-it/258539 "2020-12-16T02:36:44Z")
The situation is that before the es statement real executes I need to validate it to guarantee it will work at the time point expected. Runtime error can be tolerated while the semantic error is not. Thanks. --- ## [How to change the field type in an ElasticSearch Index?](https://discuss.elastic.co/t/how-to-change-the-field-type-in-an-elasticsearch-index/258457)
**Author:** [@devbot](https://discuss.elastic.co/u/devbot)\ **Replies:** 2\ **Last updated:** [December 16, 2020, 2:34am UTC](https://discuss.elastic.co/t/how-to-change-the-field-type-in-an-elasticsearch-index/258457 "2020-12-16T02:34:18Z")
I have index\_A, which includes a number field "foo". I copy the mapping for index\_A, and make a dev tools call PUT /index\_B with the field foo changed to text, so the mapping portion of that is: "foo": { "type": … --- ## [Why does functionbeat for AWS need to be able to make Cloudformation actions?](https://discuss.elastic.co/t/why-does-functionbeat-for-aws-need-to-be-able-to-make-cloudformation-actions/258647)
**Author:** [@Jonathan\_Detert](https://discuss.elastic.co/u/Jonathan_Detert)\ **Replies:** 1\ **Last updated:** [December 16, 2020, 1:52am UTC](https://discuss.elastic.co/t/why-does-functionbeat-for-aws-need-to-be-able-to-make-cloudformation-actions/258647 "2020-12-16T01:52:51Z")
The IAM permissions doc for functionbeat lists a bunch of Cloudformation actions to be granted. What are they needed for? For the deployment process only, or something else? Thanks --- ## [Metricbeat AWS RDS Module not retrieving db\_instance.identifiers](https://discuss.elastic.co/t/metricbeat-aws-rds-module-not-retrieving-db-instance-identifiers/258174)
**Author:** [@achalamalasetti](https://discuss.elastic.co/u/achalamalasetti)\ **Replies:** 2\ **Last updated:** [December 16, 2020, 1:51am UTC](https://discuss.elastic.co/t/metricbeat-aws-rds-module-not-retrieving-db-instance-identifiers/258174 "2020-12-16T01:51:12Z")
we are using metricbeat (7.10.0) -\> AWS module, RDS metrics. The metric data that is pulled looks incomplete. it doesn't retrieve aws.rds.db\_instance.engine\_name for some and for some it doesn't retrieve aws.rds.db\_inst… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1640) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1642)