# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1680 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1681 --- ## [Parent/Child relationships](https://discuss.elastic.co/t/parent-child-relationships/256475)
**Author:** [@SergioRodenas](https://discuss.elastic.co/u/SergioRodenas)\ **Replies:** 0\ **Last updated:** [November 24, 2020, 9:25am UTC](https://discuss.elastic.co/t/parent-child-relationships/256475 "2020-11-24T09:25:44Z")
Hi I'm using the example from the NEST documentation, https://www.elastic.co/guide/en/elasticsearch/client/net-api/current/parent-child-relationships.html The index has been created and the mapping too, but the document… --- ## [Watcher](https://discuss.elastic.co/t/watcher/256265)
**Author:** [@Farid\_N](https://discuss.elastic.co/u/Farid_N)\ **Replies:** 2\ **Last updated:** [November 24, 2020, 9:12am UTC](https://discuss.elastic.co/t/watcher/256265 "2020-11-24T09:12:16Z")
Hi How can I solve this error? I think my condition is incorrect: "source": "if(ctx.payload.\_source.elasticsearch.cluster.stats.status == \[yellow\] || ctx.payload.\_source.elasticsearch.cluster.stats.nodes.count \<= 4… --- ## [Reindexig after update](https://discuss.elastic.co/t/reindexig-after-update/256350)
**Author:** [@azxqw](https://discuss.elastic.co/u/azxqw)\ **Replies:** 3\ **Last updated:** [November 24, 2020, 9:06am UTC](https://discuss.elastic.co/t/reindexig-after-update/256350 "2020-11-24T09:06:57Z")
Hi, I recently updated my elasticsearch & kibana from 5.6 to 6.8. everything worked great and the update was smooth. however, now that i update my logstash, i get the following error - " \[Rejecting mapping update to a… --- ## [Json format too bloated](https://discuss.elastic.co/t/json-format-too-bloated/256424)
**Author:** [@kartoffelsack](https://discuss.elastic.co/u/kartoffelsack)\ **Replies:** 3\ **Last updated:** [November 24, 2020, 9:06am UTC](https://discuss.elastic.co/t/json-format-too-bloated/256424 "2020-11-24T09:06:44Z")
we store not too small json documents in elasticsearch. We will add 10s of millions of documents every month. We found that storing 30 mio documents eats up 2 TB of data. As the format is json, there is a lot of repeti… --- ## [Elasticsearch service getting failed when /tmp is mounted no exec](https://discuss.elastic.co/t/elasticsearch-service-getting-failed-when-tmp-is-mounted-no-exec/256104)
**Author:** [@prat](https://discuss.elastic.co/u/prat)\ **Replies:** 3\ **Last updated:** [November 24, 2020, 6:51am UTC](https://discuss.elastic.co/t/elasticsearch-service-getting-failed-when-tmp-is-mounted-no-exec/256104 "2020-11-24T06:51:44Z")
Hi Team, elasticsearch service is getting failed when /tmp is mounted with noexec, when try to remount it with exec , service is getting started. Is below link still valid or there is parmenent solution or workaround ? … --- ## [Use a variable from one grok to another for all lines from a log file](https://discuss.elastic.co/t/use-a-variable-from-one-grok-to-another-for-all-lines-from-a-log-file/256470)
**Author:** [@Blazkowicz](https://discuss.elastic.co/u/Blazkowicz)\ **Replies:** 0\ **Last updated:** [November 24, 2020, 8:58am UTC](https://discuss.elastic.co/t/use-a-variable-from-one-grok-to-another-for-all-lines-from-a-log-file/256470 "2020-11-24T08:58:56Z")
Hi all, I have searched the forum for this type of question but what I have found I did not manage to make use of it. I am a newbie in all of ELK stack. Any help would be highly appreciated. I have the following log ty… --- ## [Indices in delete phase are actually not being deleted](https://discuss.elastic.co/t/indices-in-delete-phase-are-actually-not-being-deleted/256462)
**Author:** [@Dabo\_Sata](https://discuss.elastic.co/u/Dabo_Sata)\ **Replies:** 4\ **Last updated:** [November 24, 2020, 8:30am UTC](https://discuss.elastic.co/t/indices-in-delete-phase-are-actually-not-being-deleted/256462 "2020-11-24T08:30:51Z")
Hi, I have some metricbeat indices that are in delete phase but the actual deletion does not occur. If I run \_ilm/explain on one of those indices I get: { "indices" : { "metricbeat-7.10.0-2020.11.19-0… --- ## [How to get kibana scripted fields in es2csv](https://discuss.elastic.co/t/how-to-get-kibana-scripted-fields-in-es2csv/256449)
**Author:** [@Abhi6](https://discuss.elastic.co/u/Abhi6)\ **Replies:** 4\ **Last updated:** [November 24, 2020, 8:26am UTC](https://discuss.elastic.co/t/how-to-get-kibana-scripted-fields-in-es2csv/256449 "2020-11-24T08:26:24Z")
I am trying to get kibana scripted fields in es2csv but column values coming empty. Thanks in advance !!! --- ## [What's the difference between es's match search and luence search](https://discuss.elastic.co/t/whats-the-difference-between-ess-match-search-and-luence-search/256095)
**Author:** [@ocean\_shi](https://discuss.elastic.co/u/ocean_shi)\ **Replies:** 12\ **Last updated:** [November 24, 2020, 8:25am UTC](https://discuss.elastic.co/t/whats-the-difference-between-ess-match-search-and-luence-search/256095 "2020-11-24T08:25:17Z")
it's can get when i search use es match query.the match query is like {"query": { "bool": { "must": \[ { "match": { "message": "too long"} }\], "… --- ## [Filebeat two diffrent input - one logstash](https://discuss.elastic.co/t/filebeat-two-diffrent-input-one-logstash/256353)
**Author:** [@langol93](https://discuss.elastic.co/u/langol93)\ **Replies:** 2\ **Last updated:** [November 24, 2020, 8:21am UTC](https://discuss.elastic.co/t/filebeat-two-diffrent-input-one-logstash/256353 "2020-11-24T08:21:40Z")
Good Morning I have a little problem with filebeat configuration. I tried use two diffrent inputs in filebeat config file: mqtt and httpjson and pass the results to one logstash instance. This solution isn't work for m… --- ## [StatusCodeError: Request Timeout after 30000ms in Node JS](https://discuss.elastic.co/t/statuscodeerror-request-timeout-after-30000ms-in-node-js/256461)
**Author:** [@zeussyed](https://discuss.elastic.co/u/zeussyed)\ **Replies:** 0\ **Last updated:** [November 24, 2020, 8:15am UTC](https://discuss.elastic.co/t/statuscodeerror-request-timeout-after-30000ms-in-node-js/256461 "2020-11-24T08:15:18Z")
I am using elasticSearch 16.7.1 I am doing a multisearch query from node js. In my local environment, I am able to get the results from the elastic server which is running on http://elasticsearch.tpconnects.com:9200. … --- ## [Gsub replace based on pattern](https://discuss.elastic.co/t/gsub-replace-based-on-pattern/256352)
**Author:** [@Muhammad\_Faisal](https://discuss.elastic.co/u/Muhammad_Faisal)\ **Replies:** 7\ **Last updated:** [November 24, 2020, 7:53am UTC](https://discuss.elastic.co/t/gsub-replace-based-on-pattern/256352 "2020-11-24T07:53:59Z")
i have log in below format , i need to replace ":" from 17:18:12 to 17-18-12 ...as this colon is also present at other places in line , how to match this mutate { gsub =\> \[ "message", "\\d\\d:\\d\\d:\\d\\d", "\\d\\d-\\d\\d-\\d\\d" … --- ## [Compare Logstash Old Event Against New One and Make Math Operation](https://discuss.elastic.co/t/compare-logstash-old-event-against-new-one-and-make-math-operation/256457)
**Author:** [@rknd](https://discuss.elastic.co/u/rknd)\ **Replies:** 0\ **Last updated:** [November 24, 2020, 7:48am UTC](https://discuss.elastic.co/t/compare-logstash-old-event-against-new-one-and-make-math-operation/256457 "2020-11-24T07:48:26Z")
Hello everyone, I want to compare the time object in each row with the next date object and get the difference between them and print them on the screen. I tried Aggregate plugin, Elapsed plugin, but could not reach the… --- ## [\[ilm\] index back to hot after being in warm pahse](https://discuss.elastic.co/t/ilm-index-back-to-hot-after-being-in-warm-pahse/256454)
**Author:** [@Ahmed\_Abdulaleem](https://discuss.elastic.co/u/Ahmed_Abdulaleem)\ **Replies:** 0\ **Last updated:** [November 24, 2020, 7:28am UTC](https://discuss.elastic.co/t/ilm-index-back-to-hot-after-being-in-warm-pahse/256454 "2020-11-24T07:28:45Z")
Hello, I have noticed that the index back to hot after being in the warm phase what's wrong I did --- ## [Master not discovered exception](https://discuss.elastic.co/t/master-not-discovered-exception/256215)
**Author:** [@nandinireddy](https://discuss.elastic.co/u/nandinireddy)\ **Replies:** 7\ **Last updated:** [November 24, 2020, 7:26am UTC](https://discuss.elastic.co/t/master-not-discovered-exception/256215 "2020-11-24T07:26:55Z")
Hi, i have configured Elasticsearch through docker swarm. When i do deploy of swarm every container in nodes are up and running but when i checked elastic search from browser getting master not discovered exception. Help… --- ## [Logstash immediately shuts down upon launch in container due to YAML](https://discuss.elastic.co/t/logstash-immediately-shuts-down-upon-launch-in-container-due-to-yaml/256452)
**Author:** [@weiyentan](https://discuss.elastic.co/u/weiyentan)\ **Replies:** 1\ **Last updated:** [November 24, 2020, 7:10am UTC](https://discuss.elastic.co/t/logstash-immediately-shuts-down-upon-launch-in-container-due-to-yaml/256452 "2020-11-24T07:10:43Z")
Hi, I have a logstash.yml file that I am using the http api listener. I have it listening for some post request inputs that has some Json bod's. Now i am in the process of processing the json. I have some complex json … --- ## [Help with conversion](https://discuss.elastic.co/t/help-with-conversion/256403)
**Author:** [@Marcin\_Kr](https://discuss.elastic.co/u/Marcin_Kr)\ **Replies:** 2\ **Last updated:** [November 24, 2020, 7:09am UTC](https://discuss.elastic.co/t/help-with-conversion/256403 "2020-11-24T07:09:21Z")
Hi guys, I've created logstash file with csv filter like below. It's working but i need to export timestamp field as "date" into elastic. I decided to use convert function but it's not working. Can You help ? ''' inp… --- ## [Elastic Search Snapshot Repo](https://discuss.elastic.co/t/elastic-search-snapshot-repo/256069)
**Author:** [@alpha\_10](https://discuss.elastic.co/u/alpha_10)\ **Replies:** 4\ **Last updated:** [November 24, 2020, 6:26am UTC](https://discuss.elastic.co/t/elastic-search-snapshot-repo/256069 "2020-11-24T06:26:33Z")
HI, i am newbie in elastic search. i have installed on my system and up 3 nodes. i have tried all CRUD operations successfully. now i am trying to register a local backup repo to take snapshot of my ealstic search cont… --- ## [Logatsh unable to read custom logstash.conf file](https://discuss.elastic.co/t/logatsh-unable-to-read-custom-logstash-conf-file/256450)
**Author:** [@devdatta\_mulgund](https://discuss.elastic.co/u/devdatta_mulgund)\ **Replies:** 0\ **Last updated:** [November 24, 2020, 6:24am UTC](https://discuss.elastic.co/t/logatsh-unable-to-read-custom-logstash-conf-file/256450 "2020-11-24T06:24:52Z")
Logatsh is unable to read custom logstash.conf file and it's pointing to the default file path. i.e /usr/share/logstash/pipeline/logstash.conf. docker-compose.yml version: '3.2' services: elasticsearch: build:… --- ## [Failed to create monitoring event {:message=\>"For path: http\_address. Map keys: \[:jvm, :os, :stats\]", :error=\>"LogStash::Instrument::MetricStore::MetricNotFoun](https://discuss.elastic.co/t/failed-to-create-monitoring-event-message-for-path-http-address-map-keys-jvm-os-stats-error-logstash-metricnotfoun/255939)
**Author:** [@devdatta\_mulgund](https://discuss.elastic.co/u/devdatta_mulgund)\ **Replies:** 7\ **Last updated:** [November 24, 2020, 6:05am UTC](https://discuss.elastic.co/t/failed-to-create-monitoring-event-message-for-path-http-address-map-keys-jvm-os-stats-error-logstash-metricnotfoun/255939 "2020-11-24T06:05:08Z")
I am facing the below error while starting the Logstash. Please note I am using docker-compose Below is the Logstash configuration. logstash.yml Default Logstash configuration from Logstash base image. http.host: "0… --- ## [Failed to execute watch](https://discuss.elastic.co/t/failed-to-execute-watch/256213)
**Author:** [@devdatta\_mulgund](https://discuss.elastic.co/u/devdatta_mulgund)\ **Replies:** 2\ **Last updated:** [November 24, 2020, 5:58am UTC](https://discuss.elastic.co/t/failed-to-execute-watch/256213 "2020-11-24T05:58:14Z")
I am facing the below errors in elastic search. Please note I am using docker-compose \*\*Elasticsearch logs\*\* cluster.name": "docker-cluster", "node.name": "482e9f3c4d6a", "message": "using \[1\] data paths, mounts \[\[/usr… --- ## [Search based on percentage of similarity](https://discuss.elastic.co/t/search-based-on-percentage-of-similarity/256444)
**Author:** [@iljoaco2](https://discuss.elastic.co/u/iljoaco2)\ **Replies:** 0\ **Last updated:** [November 24, 2020, 5:58am UTC](https://discuss.elastic.co/t/search-based-on-percentage-of-similarity/256444 "2020-11-24T05:58:07Z")
Hello, I am trying to find one or more names in a field of an index, but I need to indicate two values ​​in the search that reduce the results. These two child values: Percentage of similarity between searched and foun… --- ## [java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit](https://discuss.elastic.co/t/java-lang-illegalstateexception-logstash-stopped-processing-because-of-an-error-systemexit-exit/256380)
**Author:** [@Palash\_Dubey](https://discuss.elastic.co/u/Palash_Dubey)\ **Replies:** 2\ **Last updated:** [November 24, 2020, 5:57am UTC](https://discuss.elastic.co/t/java-lang-illegalstateexception-logstash-stopped-processing-because-of-an-error-systemexit-exit/256380 "2020-11-24T05:57:16Z")
\[ERROR\]\[logstash.agent\] Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"Java::JavaLang::IllegalStateException", :message=\>"Unable to configure plugins: (ConfigurationErr… --- ## [Split double nested json array - http poller logstash](https://discuss.elastic.co/t/split-double-nested-json-array-http-poller-logstash/256440)
**Author:** [@sachin10](https://discuss.elastic.co/u/sachin10)\ **Replies:** 0\ **Last updated:** [November 24, 2020, 5:19am UTC](https://discuss.elastic.co/t/split-double-nested-json-array-http-poller-logstash/256440 "2020-11-24T05:19:22Z")
I would like to to retrieve every element in below JSON to be a separate field so as to visualize in kibana by applying metrics in dashboard. I'm using http poller plugin to do this task and i used below filter to split… --- ## [Filebeat not reading 1st log in a file](https://discuss.elastic.co/t/filebeat-not-reading-1st-log-in-a-file/256076)
**Author:** [@Ameer\_Mukadam](https://discuss.elastic.co/u/Ameer_Mukadam)\ **Replies:** 6\ **Last updated:** [November 24, 2020, 5:08am UTC](https://discuss.elastic.co/t/filebeat-not-reading-1st-log-in-a-file/256076 "2020-11-24T05:08:56Z")
I am pulling mimecast email logs using a python script and saving it to a folder the logs are in json and each file only has 1 log, I have configured my filebeat to read logs from the directory where the logs are stored … --- ## [KIbana Index always reset suddenly](https://discuss.elastic.co/t/kibana-index-always-reset-suddenly/256298)
**Author:** [@Junedi\_Rajagukguk](https://discuss.elastic.co/u/Junedi_Rajagukguk)\ **Replies:** 10\ **Last updated:** [November 24, 2020, 4:28am UTC](https://discuss.elastic.co/t/kibana-index-always-reset-suddenly/256298 "2020-11-24T04:28:42Z")
Hello, i want to ask why my data in kibana always reset with randomly time. ( i noticed this when i open discover, the data date always reset) i've been searching for long time and yet i still don't get the solution. … --- ## ["Caused by: org.elasticsearch.common.breaker.CircuitBreakingException: \[parent\]](https://discuss.elastic.co/t/caused-by-org-elasticsearch-common-breaker-circuitbreakingexception-parent/256370)
**Author:** [@uttam.anand](https://discuss.elastic.co/u/uttam.anand)\ **Replies:** 3\ **Last updated:** [November 24, 2020, 4:24am UTC](https://discuss.elastic.co/t/caused-by-org-elasticsearch-common-breaker-circuitbreakingexception-parent/256370 "2020-11-24T04:24:39Z")
Hi Guys, I am facing the below issue since few days now -: "Caused by: org.elasticsearch.common.breaker.CircuitBreakingException: \[parent\] Data too large, data for \[\\] would be \[24876638648/23.1gb\], w… --- ## [After adding the filter, executing the query will cause the kibana container to restart](https://discuss.elastic.co/t/after-adding-the-filter-executing-the-query-will-cause-the-kibana-container-to-restart/256430)
**Author:** [@yt\_h](https://discuss.elastic.co/u/yt_h)\ **Replies:** 7\ **Last updated:** [November 24, 2020, 3:06am UTC](https://discuss.elastic.co/t/after-adding-the-filter-executing-the-query-will-cause-the-kibana-container-to-restart/256430 "2020-11-24T03:06:21Z")
I hide the unnecessary domain name display kibana completes the error: Error: Request to Elasticsearch failed: {"error":{}} at http://kibana.platform.abc.cn/bundles/commons.bundle.js:3:4900279 at Function.\_mo… --- ## [Configure Packetbeat prior to building MacOS pkg](https://discuss.elastic.co/t/configure-packetbeat-prior-to-building-macos-pkg/256204)
**Author:** [@AaronWF](https://discuss.elastic.co/u/AaronWF)\ **Replies:** 5\ **Last updated:** [November 24, 2020, 2:57am UTC](https://discuss.elastic.co/t/configure-packetbeat-prior-to-building-macos-pkg/256204 "2020-11-24T02:57:39Z")
I am building beats on MacOS for the native integration feature, I have successfully built & deployed auditbeat, and during the build process I was able to find the file which the build was using in the template. File l… --- ## [Logstash s3 input plugin: not indexing files under individual folder of bucket using prefix option](https://discuss.elastic.co/t/logstash-s3-input-plugin-not-indexing-files-under-individual-folder-of-bucket-using-prefix-option/256313)
**Author:** [@Ravi\_Kumar\_Reddy](https://discuss.elastic.co/u/Ravi_Kumar_Reddy)\ **Replies:** 0\ **Last updated:** [November 23, 2020, 7:34am UTC](https://discuss.elastic.co/t/logstash-s3-input-plugin-not-indexing-files-under-individual-folder-of-bucket-using-prefix-option/256313 "2020-11-23T07:34:11Z")
s3 bucket : elk folders: syslog, errorlog etc.. filepattern: syslog- input { s3 { access\_key\_id =\> "" secret\_access\_key =\> "" bucket =\> "elk" region =\> "eu-central-1" prefix =\> "syslog/syslog-" additional\_settin… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1679) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1681)