# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1656 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1657 --- ## [Unbalanced disk usage ES 7.9.2](https://discuss.elastic.co/t/unbalanced-disk-usage-es-7-9-2/257955)
**Author:** [@111266](https://discuss.elastic.co/u/111266)\ **Replies:** 0\ **Last updated:** [December 8, 2020, 8:53am UTC](https://discuss.elastic.co/t/unbalanced-disk-usage-es-7-9-2/257955 "2020-12-08T08:53:17Z")
Hello. Have cluster with 3 nodes and on each node the disk is busy in different ways: node1 - free space 955.8gb node3 - free space 1.9tb node2 - free space 581.9gb All nodes have 5tb disk space and equal resourc… --- ## [Failed to execute 'Download CSV'](https://discuss.elastic.co/t/failed-to-execute-download-csv/257603)
**Author:** [@t98907](https://discuss.elastic.co/u/t98907)\ **Replies:** 6\ **Last updated:** [December 8, 2020, 8:52am UTC](https://discuss.elastic.co/t/failed-to-execute-download-csv/257603 "2020-12-08T08:52:02Z")
Hi there, Kibana: 7.8.0 'Download CSV' failed even though I am logged in as 'elastic' user. Must '\_source' be enabled on the index to run 'Download CSV'? --- ## [Elastic search stack upgradation on Kubernetes](https://discuss.elastic.co/t/elastic-search-stack-upgradation-on-kubernetes/257952)
**Author:** [@anand\_kumar2](https://discuss.elastic.co/u/anand_kumar2)\ **Replies:** 0\ **Last updated:** [December 8, 2020, 8:15am UTC](https://discuss.elastic.co/t/elastic-search-stack-upgradation-on-kubernetes/257952 "2020-12-08T08:15:49Z")
Dear Techies, I am planning to upgrade EFK stack to upgrade on Kubernetes, while reading the blogs before upgradation I get to know about EFK stack should be upgrade on same version. At present version we are running … --- ## [Elasticsearch unwanted lowercase when indexing](https://discuss.elastic.co/t/elasticsearch-unwanted-lowercase-when-indexing/257954)
**Author:** [@bogdan\_copocean](https://discuss.elastic.co/u/bogdan_copocean)\ **Replies:** 1\ **Last updated:** [December 8, 2020, 8:42am UTC](https://discuss.elastic.co/t/elasticsearch-unwanted-lowercase-when-indexing/257954 "2020-12-08T08:42:02Z")
Hi there, I have an indexing problem with Elasticsearch. I have a field with the type "text" that makes its value lowercase. I'm using Hot-Warm-Architecture policy with index templates where I specify shard settings an… --- ## [ElasticSerach Not Working](https://discuss.elastic.co/t/elasticserach-not-working/257950)
**Author:** [@Shashank\_Tripathi](https://discuss.elastic.co/u/Shashank_Tripathi)\ **Replies:** 1\ **Last updated:** [December 8, 2020, 8:36am UTC](https://discuss.elastic.co/t/elasticserach-not-working/257950 "2020-12-08T08:36:52Z")
running : /opt/elk/elasticsearch-7.10.0/bin/elasticsearch on RHEL Instance. I Have tried all possible ways to run elastic search on my RHEL instance but still i am not getting the desired result. when i hit elk server… --- ## [Span\_near fails to work as expected](https://discuss.elastic.co/t/span-near-fails-to-work-as-expected/257171)
**Author:** [@Kasper\_Kooijman](https://discuss.elastic.co/u/Kasper_Kooijman)\ **Replies:** 3\ **Last updated:** [December 8, 2020, 8:34am UTC](https://discuss.elastic.co/t/span-near-fails-to-work-as-expected/257171 "2020-12-08T08:34:57Z")
I have an Elasticsearch index structured as follows: Example entry: { 'ID': '1', 'creator': 'Sam', 'instance': 'court of cassation', 'text': \[ { 'depth': 0, 'role': 'introduction', 'caseText… --- ## [Elasticsearch Cluster - Difference is storage usage between nodes](https://discuss.elastic.co/t/elasticsearch-cluster-difference-is-storage-usage-between-nodes/257934)
**Author:** [@RAM\_NATHAN](https://discuss.elastic.co/u/RAM_NATHAN)\ **Replies:** 7\ **Last updated:** [December 8, 2020, 7:20am UTC](https://discuss.elastic.co/t/elasticsearch-cluster-difference-is-storage-usage-between-nodes/257934 "2020-12-08T07:20:53Z")
Hi Im having 3 node cluster with / partition has 32 GB. ES data folder is /var/lib/elasticsearch which is below / partition. Before I run load testing, I had 8 Million records and "used storage" details is below node … --- ## [Elastic ingest pipeline grok filter error](https://discuss.elastic.co/t/elastic-ingest-pipeline-grok-filter-error/257706)
**Author:** [@vsv0001](https://discuss.elastic.co/u/vsv0001)\ **Replies:** 2\ **Last updated:** [December 8, 2020, 3:05am UTC](https://discuss.elastic.co/t/elastic-ingest-pipeline-grok-filter-error/257706 "2020-12-08T03:05:03Z")
hi, I am trying to to build an ingest pipeline using grok processor my grok filter works on the Kibana-\>console . grok filter ^%{YEAR}-%{MONTHNUM}-%{MONTHDAY} %{TIME}.%{LOGLEVEL:log-level} : \\\[%{DATA:user}\] \\\[%{DATA:… --- ## [How to get index to refresh automatically, even when not receiving queries?](https://discuss.elastic.co/t/how-to-get-index-to-refresh-automatically-even-when-not-receiving-queries/257929)
**Author:** [@redec](https://discuss.elastic.co/u/redec)\ **Replies:** 2\ **Last updated:** [December 8, 2020, 2:49am UTC](https://discuss.elastic.co/t/how-to-get-index-to-refresh-automatically-even-when-not-receiving-queries/257929 "2020-12-08T02:49:45Z")
Is there any way to get elasticsearch to automatically refresh an index even if it never gets any queries? The reason I need to do this is I have a process which is constantly running, updating my index with delta updat… --- ## [Is there a snapshot limit for your hosted solution?](https://discuss.elastic.co/t/is-there-a-snapshot-limit-for-your-hosted-solution/257925)
**Author:** [@seanziee](https://discuss.elastic.co/u/seanziee)\ **Replies:** 5\ **Last updated:** [December 8, 2020, 2:00am UTC](https://discuss.elastic.co/t/is-there-a-snapshot-limit-for-your-hosted-solution/257925 "2020-12-08T02:00:54Z")
I have ES installed on your cloud enterprise service. Previously there was a snapshot tab that yo could choose how frequently to create snapshots (and there was a max limit of the total amount of snapshots you could have… --- ## [Error while starting logstash](https://discuss.elastic.co/t/error-while-starting-logstash/257895)
**Author:** [@Lipi\_Lapsiwala](https://discuss.elastic.co/u/Lipi_Lapsiwala)\ **Replies:** 6\ **Last updated:** [December 8, 2020, 1:32am UTC](https://discuss.elastic.co/t/error-while-starting-logstash/257895 "2020-12-08T01:32:56Z")
I am trying to integrate Elastic stack (Logstash, ElasticSearch and Kibana) with IBM websphere liberty profile. I have successfully created and configured server.xml file in wlp and able to start and access the server. I… --- ## [Integer cannot be casted to long bis](https://discuss.elastic.co/t/integer-cannot-be-casted-to-long-bis/257799)
**Author:** [@gabriel\_tessier](https://discuss.elastic.co/u/gabriel_tessier)\ **Replies:** 3\ **Last updated:** [December 8, 2020, 1:20am UTC](https://discuss.elastic.co/t/integer-cannot-be-casted-to-long-bis/257799 "2020-12-08T01:20:32Z")
Hi, Following this topic that had no replies: I made more tests against several available version of elastic I have. Using this code: POST \_ingest/pipeline/\_simulate { "pipeline" : { "description": "test", … --- ## [Can't send logs by filebeat to logstash in Kubernetes](https://discuss.elastic.co/t/cant-send-logs-by-filebeat-to-logstash-in-kubernetes/257851)
**Author:** [@iooi](https://discuss.elastic.co/u/iooi)\ **Replies:** 0\ **Last updated:** [December 7, 2020, 12:55pm UTC](https://discuss.elastic.co/t/cant-send-logs-by-filebeat-to-logstash-in-kubernetes/257851 "2020-12-07T12:55:20Z")
Configuration nginx.yaml --- apiVersion: v1 kind: Namespace metadata: name: beats --- apiVersion: apps/v1 kind: Deployment metadata: namespace: beats name: nginx spec: replicas: 1 selector: matchLabels: … --- ## [Store enum as keyword VS integer](https://discuss.elastic.co/t/store-enum-as-keyword-vs-integer/257903)
**Author:** [@lang1991](https://discuss.elastic.co/u/lang1991)\ **Replies:** 1\ **Last updated:** [December 8, 2020, 12:53am UTC](https://discuss.elastic.co/t/store-enum-as-keyword-vs-integer/257903 "2020-12-08T00:53:27Z")
We have a layer on top of Elasticsearch to translate enums into their numeric values before querying and indexing, but I am wondering if that's necessary at all for storage savings and query performance when compared wit… --- ## [7.9 -\> 7.10 ECK experience](https://discuss.elastic.co/t/7-9-7-10-eck-experience/257510)
**Author:** [@3266miles](https://discuss.elastic.co/u/3266miles)\ **Replies:** 5\ **Last updated:** [December 7, 2020, 11:38pm UTC](https://discuss.elastic.co/t/7-9-7-10-eck-experience/257510 "2020-12-07T23:38:31Z")
So I've recently migrated our observability cluster from Elastic 7.9 to Elastic 7.10, and noticed some interesting gotchas that are worthy of discussion. I don't think these are bugs per say but there is definitely some … --- ## [Limit on # of data nodes?](https://discuss.elastic.co/t/limit-on-of-data-nodes/257912)
**Author:** [@Jesbourne](https://discuss.elastic.co/u/Jesbourne)\ **Replies:** 10\ **Last updated:** [December 7, 2020, 10:41pm UTC](https://discuss.elastic.co/t/limit-on-of-data-nodes/257912 "2020-12-07T22:41:17Z")
Is there a limit on the number of data nodes or overall amount of data we can have in a cluster? How can we tell when we're nearing that limit? We've been told a few times by elastic employees that our limit is probably… --- ## [Indexing to index2](https://discuss.elastic.co/t/indexing-to-index2/257919)
**Author:** [@Eddie\_Adams](https://discuss.elastic.co/u/Eddie_Adams)\ **Replies:** 3\ **Last updated:** [December 7, 2020, 10:36pm UTC](https://discuss.elastic.co/t/indexing-to-index2/257919 "2020-12-07T22:36:49Z")
Is it possible to make an index1 readonly and index documents not present in index1 to index2? --- ## [How to parse an array of multi-line json objects as separate documents in ES?](https://discuss.elastic.co/t/how-to-parse-an-array-of-multi-line-json-objects-as-separate-documents-in-es/255230)
**Author:** [@reillye](https://discuss.elastic.co/u/reillye)\ **Replies:** 3\ **Last updated:** [December 7, 2020, 10:22pm UTC](https://discuss.elastic.co/t/how-to-parse-an-array-of-multi-line-json-objects-as-separate-documents-in-es/255230 "2020-12-07T22:22:41Z")
I have a use case where I am going to be receiving a new file every hour that is picked up by filebeat and then sent to logstash. The file will look like this: \[ { "Results": { "StartWeekSec": \[ 2000, 1980… --- ## [Kibana, xpack, nginx proxy and authentication](https://discuss.elastic.co/t/kibana-xpack-nginx-proxy-and-authentication/257138)
**Author:** [@annanicotera](https://discuss.elastic.co/u/annanicotera)\ **Replies:** 2\ **Last updated:** [December 7, 2020, 10:06pm UTC](https://discuss.elastic.co/t/kibana-xpack-nginx-proxy-and-authentication/257138 "2020-12-07T22:06:53Z")
Hello, We have embedded Kibana dashboards in our application. if xpack security is enabled, we configure a nginx proxy so that the user viewing the dashboards can seamlessly access/view the dashboards without having to … --- ## [Rsyslog vs filebeat](https://discuss.elastic.co/t/rsyslog-vs-filebeat/257904)
**Author:** [@droidus](https://discuss.elastic.co/u/droidus)\ **Replies:** 1\ **Last updated:** [December 7, 2020, 10:07pm UTC](https://discuss.elastic.co/t/rsyslog-vs-filebeat/257904 "2020-12-07T22:07:01Z")
What is the best way to monitor my hosts? Should I stand up a rsyslog server, and then have clients send logs there, then forward to logstash, or should the clients just send them right to logstash? --- ## [TSVB Visualization is working differently in Read Only mode dashboard](https://discuss.elastic.co/t/tsvb-visualization-is-working-differently-in-read-only-mode-dashboard/257913)
**Author:** [@gaurav1](https://discuss.elastic.co/u/gaurav1)\ **Replies:** 0\ **Last updated:** [December 7, 2020, 9:26pm UTC](https://discuss.elastic.co/t/tsvb-visualization-is-working-differently-in-read-only-mode-dashboard/257913 "2020-12-07T21:26:20Z")
I have used Markdown in TSVB visualization for creating a master dashboards which contains static data like dashboard name and its URL. The standalone markdown visualization does not support CSS for formatting the text s… --- ## [Multiple pipelines output to one cluster - only one of them picks up logs](https://discuss.elastic.co/t/multiple-pipelines-output-to-one-cluster-only-one-of-them-picks-up-logs/257877)
**Author:** [@Ilya\_Geller](https://discuss.elastic.co/u/Ilya_Geller)\ **Replies:** 4\ **Last updated:** [December 7, 2020, 8:38pm UTC](https://discuss.elastic.co/t/multiple-pipelines-output-to-one-cluster-only-one-of-them-picks-up-logs/257877 "2020-12-07T20:38:48Z")
Hi, I have a logstash node that has two pipelines that pick up different inputs and do separate things but both of them output to the same ES cluster into different indeces. Both pipelines have the following defined: … --- ## [Ingest pipeline grok processor on\_failure](https://discuss.elastic.co/t/ingest-pipeline-grok-processor-on-failure/257755)
**Author:** [@vsv0001](https://discuss.elastic.co/u/vsv0001)\ **Replies:** 1\ **Last updated:** [December 7, 2020, 8:36pm UTC](https://discuss.elastic.co/t/ingest-pipeline-grok-processor-on-failure/257755 "2020-12-07T20:36:12Z")
Hi, I have an elastic ingest pipeline with grok processor defined along with error handling { "my\_ingest" : { "description" : "parse multiple patterns", "processors" : \[ { "grok" : { "… --- ## [Elasticsearch Ingest Node or Filebeats processors or Logstash to add fields to my logs](https://discuss.elastic.co/t/elasticsearch-ingest-node-or-filebeats-processors-or-logstash-to-add-fields-to-my-logs/257709)
**Author:** [@ghettosamson](https://discuss.elastic.co/u/ghettosamson)\ **Replies:** 2\ **Last updated:** [December 7, 2020, 8:12pm UTC](https://discuss.elastic.co/t/elasticsearch-ingest-node-or-filebeats-processors-or-logstash-to-add-fields-to-my-logs/257709 "2020-12-07T20:12:45Z")
I am running Dockerized Elastic Stack on a single AWS EC2 instance, with Packetbeats, Filebeats, Metricbeats, Kibana and Elasticsearch. I've been reading the documentation over this past week and I need help determining … --- ## [Including dynamic templates for the elastic index](https://discuss.elastic.co/t/including-dynamic-templates-for-the-elastic-index/257784)
**Author:** [@radhika](https://discuss.elastic.co/u/radhika)\ **Replies:** 3\ **Last updated:** [December 7, 2020, 8:03pm UTC](https://discuss.elastic.co/t/including-dynamic-templates-for-the-elastic-index/257784 "2020-12-07T20:03:42Z")
Hello everyone, I have an elastic index with the mappings set to strict except for one field which is dynamic. I would also like to set the mapping of the dynamic field using dynamic templates PUT trial { "mappings"… --- ## [Kafka Output fails to authenticate with kerberos](https://discuss.elastic.co/t/kafka-output-fails-to-authenticate-with-kerberos/257906)
**Author:** [@burkeg](https://discuss.elastic.co/u/burkeg)\ **Replies:** 0\ **Last updated:** [December 7, 2020, 7:57pm UTC](https://discuss.elastic.co/t/kafka-output-fails-to-authenticate-with-kerberos/257906 "2020-12-07T19:57:56Z")
I'm trying to write data to Kafka broker authenticated with Kerberos with GSSAPI and SASL. When I start the logstash agent it errors out with Receive Timeout from Kerberos but when i use kinit to get the ticket from kerb… --- ## [Modify All Logs Before Giving To Filter](https://discuss.elastic.co/t/modify-all-logs-before-giving-to-filter/257815)
**Author:** [@rknd](https://discuss.elastic.co/u/rknd)\ **Replies:** 1\ **Last updated:** [December 7, 2020, 7:50pm UTC](https://discuss.elastic.co/t/modify-all-logs-before-giving-to-filter/257815 "2020-12-07T19:50:48Z")
Hello everyone, Imagine that I have a codec plugin for input and my logs like this : 00:23 Lorem Ipsum 13:35 Lorem Ipsum 14:00 DATE-LINE 01/01/2020 15:43 Lorem Ipsum 20:20 Lorem Ipsum 00:15 Lorem Ipsum 13:10 DAT… --- ## [Cisco FTD module does not appear to be processing any events](https://discuss.elastic.co/t/cisco-ftd-module-does-not-appear-to-be-processing-any-events/257896)
**Author:** [@ThePVD](https://discuss.elastic.co/u/ThePVD)\ **Replies:** 0\ **Last updated:** [December 7, 2020, 7:00pm UTC](https://discuss.elastic.co/t/cisco-ftd-module-does-not-appear-to-be-processing-any-events/257896 "2020-12-07T19:00:47Z")
Helllo! I am currently troubleshooting sending FTD syslog output to a filebeat listener. I'm able to sniff traffic and see packets arriving, but filebeat does not seem to do ANYTHING with the event. I've experimented … --- ## [Help with \`docCount\`](https://discuss.elastic.co/t/help-with-doccount/257894)
**Author:** [@tiagokalinke](https://discuss.elastic.co/u/tiagokalinke)\ **Replies:** 0\ **Last updated:** [December 7, 2020, 6:57pm UTC](https://discuss.elastic.co/t/help-with-doccount/257894 "2020-12-07T18:57:55Z")
Hi. I am using the Explain API to understand the relevance of a result. However, for each request the docCount is varying. { "size": 6, "query": { "bool": { "must": \[ … --- ## [Trying to forward multiple filebeats via a filebeat relay](https://discuss.elastic.co/t/trying-to-forward-multiple-filebeats-via-a-filebeat-relay/257886)
**Author:** [@dorj1234](https://discuss.elastic.co/u/dorj1234)\ **Replies:** 0\ **Last updated:** [December 7, 2020, 6:17pm UTC](https://discuss.elastic.co/t/trying-to-forward-multiple-filebeats-via-a-filebeat-relay/257886 "2020-12-07T18:17:11Z")
Hello, I have multiple machines running filebeat and a logstash host in my cloud environment. To minimize firewall impact, I created a single VM to be a relay, and forward everything from the other filebeats to the out… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1655) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1657)