# Elastic Stack

**URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1689

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1690

---

## [Using reindex to clean up a series of indexes (6.8.12)](https://discuss.elastic.co/t/using-reindex-to-clean-up-a-series-of-indexes-6-8-12/255917)

<div class="topic-metadata">

**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\
**Replies:** 1\
**Last updated:** [November 19, 2020, 2:27am UTC](https://discuss.elastic.co/t/using-reindex-to-clean-up-a-series-of-indexes-6-8-12/255917 "2020-11-19T02:27:54Z")

</div>

Background: I am attempting to get a series of indexes into a consistent form -- the indexes span two years and over that time I have learnt a lot and there have been incremental improvements in the data quality. The i…

---

## [Bulk-update challenge tuning](https://discuss.elastic.co/t/bulk-update-challenge-tuning/255686)

<div class="topic-metadata">

**Author:** [@Oleg\_Ruchovets](https://discuss.elastic.co/u/Oleg_Ruchovets)\
**Replies:** 2\
**Last updated:** [November 19, 2020, 1:43am UTC](https://discuss.elastic.co/t/bulk-update-challenge-tuning/255686 "2020-11-19T01:43:55Z")

</div>

Hello, I run the bulk-update challenge: esrally --pipeline=benchmark-only --track=eventdata --track-repository=eventdata --challenge=bulk-update --track-params=bulk\_size:10000,bulk\_indexing\_clients:64 --target-hosts=10.…

---

## [CCR within On-premises and Cloud](https://discuss.elastic.co/t/ccr-within-on-premises-and-cloud/255894)

<div class="topic-metadata">

**Author:** [@valleram](https://discuss.elastic.co/u/valleram)\
**Replies:** 2\
**Last updated:** [November 19, 2020, 1:42am UTC](https://discuss.elastic.co/t/ccr-within-on-premises-and-cloud/255894 "2020-11-19T01:42:55Z")

</div>

Hi All, Is there a way using CCR to replicate ES data from my on premise cluster to cloud using the AWS Elasticsearch Service? Any suggestion/idea would be much appreciate it. Thanks

---

## [Heartbeat enabled: false kills process with error](https://discuss.elastic.co/t/heartbeat-enabled-false-kills-process-with-error/255900)

<div class="topic-metadata">

**Author:** [@Ben\_Berg1](https://discuss.elastic.co/u/Ben_Berg1)\
**Replies:** 1\
**Last updated:** [November 18, 2020, 11:36pm UTC](https://discuss.elastic.co/t/heartbeat-enabled-false-kills-process-with-error/255900 "2020-11-18T23:36:30Z")

</div>

Hello, I am running heartbeat in a docker container. I would like to conditionally enable specific monitors using the enabled configuration option on a monitor by monitor basis. It appears enabled: false results in 202…

---

## [Update\_by\_query/delete\_by\_query conflicts=proceed doesn't actually perform the operation?](https://discuss.elastic.co/t/update-by-query-delete-by-query-conflicts-proceed-doesnt-actually-perform-the-operation/255907)

<div class="topic-metadata">

**Author:** [@redec](https://discuss.elastic.co/u/redec)\
**Replies:** 1\
**Last updated:** [November 18, 2020, 10:28pm UTC](https://discuss.elastic.co/t/update-by-query-delete-by-query-conflicts-proceed-doesnt-actually-perform-the-operation/255907 "2020-11-18T22:28:08Z")

</div>

I just discovered that conflicts=proceed doesn't mean "proceed with the requested operation when a conflict occurs"...instead it apparently means "just skip doing the requested operation on that document". I really wish…

---

## [What user role do I need need for shipping logs from fluentd to elastic search](https://discuss.elastic.co/t/what-user-role-do-i-need-need-for-shipping-logs-from-fluentd-to-elastic-search/255910)

<div class="topic-metadata">

**Author:** [@FASUGBA\_boluwatife](https://discuss.elastic.co/u/FASUGBA_boluwatife)\
**Replies:** 1\
**Last updated:** [November 18, 2020, 10:20pm UTC](https://discuss.elastic.co/t/what-user-role-do-i-need-need-for-shipping-logs-from-fluentd-to-elastic-search/255910 "2020-11-18T22:20:38Z")

</div>

Hi guys, please what user role do I need to assign to a user I created in my elastic cloud cluster to be able to forward logs from fluentd to elastic search? Thanks

---

## [Schedule Aggregate Alerts Won't Stop Alerting](https://discuss.elastic.co/t/schedule-aggregate-alerts-wont-stop-alerting/255847)

<div class="topic-metadata">

**Author:** [@joabrb22](https://discuss.elastic.co/u/joabrb22)\
**Replies:** 1\
**Last updated:** [November 18, 2020, 10:02pm UTC](https://discuss.elastic.co/t/schedule-aggregate-alerts-wont-stop-alerting/255847 "2020-11-18T22:02:17Z")

</div>

Please excuse me if this is listed in the wrong categories. I have setup Elastalert to send out a set of scheduled alerts each day at a certain time using the aggregation scheduling. The alerts usually send at the righ…

---

## [Date formatting](https://discuss.elastic.co/t/date-formatting/255898)

<div class="topic-metadata">

**Author:** [@stevezemlicka](https://discuss.elastic.co/u/stevezemlicka)\
**Replies:** 2\
**Last updated:** [November 18, 2020, 9:56pm UTC](https://discuss.elastic.co/t/date-formatting/255898 "2020-11-18T21:56:31Z")

</div>

I have a datafile I wish to ingest using Logstash. Historically I've always used CLI tools to manipulate the date/time fields to be easier to map using a .conf file (my imports tend to be CSV in nature). I was just won…

---

## [Multiple publish\_host for nodes communication behind a firewall](https://discuss.elastic.co/t/multiple-publish-host-for-nodes-communication-behind-a-firewall/255821)

<div class="topic-metadata">

**Author:** [@Vincent\_DOS\_SANTOS](https://discuss.elastic.co/u/Vincent_DOS_SANTOS)\
**Replies:** 3\
**Last updated:** [November 18, 2020, 9:48pm UTC](https://discuss.elastic.co/t/multiple-publish-host-for-nodes-communication-behind-a-firewall/255821 "2020-11-18T21:48:15Z")

</div>

Hi, we currently have a cluster in version 7.6.0, composed of 28 nodes spread over 2 datacenters : 14 in datacenter A (named es1-A, es2-A, ..., es14-A) 14 in datacenter B (named es1-B, es2-B, ..., es14-B) 3 nodes are…

---

## [Impact if disabling shards rebalancing](https://discuss.elastic.co/t/impact-if-disabling-shards-rebalancing/255831)

<div class="topic-metadata">

**Author:** [@Shubham](https://discuss.elastic.co/u/Shubham)\
**Replies:** 2\
**Last updated:** [November 18, 2020, 9:46pm UTC](https://discuss.elastic.co/t/impact-if-disabling-shards-rebalancing/255831 "2020-11-18T21:46:18Z")

</div>

Hi , Will there be any negative impact if I disallow shards rebalancing? I want to disable rebalancing because my cluster is going into yellow state too frequently as some shards become unassigned.

---

## [ElasticSearch partial word search](https://discuss.elastic.co/t/elasticsearch-partial-word-search/255888)

<div class="topic-metadata">

**Author:** [@gilleo24](https://discuss.elastic.co/u/gilleo24)\
**Replies:** 1\
**Last updated:** [November 18, 2020, 9:41pm UTC](https://discuss.elastic.co/t/elasticsearch-partial-word-search/255888 "2020-11-18T21:41:39Z")

</div>

I'm trying to search for a result by using part of a word and not getting a result. i.e. Bob's Wood Fried Pizzaeria The term "Pizza" in my search application does not bring this result back. Neither does "Woo". But …

---

## [Can anyone please explain me a query hierarchy?](https://discuss.elastic.co/t/can-anyone-please-explain-me-a-query-hierarchy/255904)

<div class="topic-metadata">

**Author:** [@lessless](https://discuss.elastic.co/u/lessless)\
**Replies:** 0\
**Last updated:** [November 18, 2020, 9:41pm UTC](https://discuss.elastic.co/t/can-anyone-please-explain-me-a-query-hierarchy/255904 "2020-11-18T21:41:36Z")

</div>

Hi, today I faced a situation when putting filters in query -\> bool -\> filter -\> bool -\> should and query -\> bool -\> filter lead to completely different results. Can anyone explain to me why is that and also please t…

---

## [Continuously copy specific documents to another index?](https://discuss.elastic.co/t/continuously-copy-specific-documents-to-another-index/255765)

<div class="topic-metadata">

**Author:** [@Thomas\_D1](https://discuss.elastic.co/u/Thomas_D1)\
**Replies:** 8\
**Last updated:** [November 18, 2020, 9:28pm UTC](https://discuss.elastic.co/t/continuously-copy-specific-documents-to-another-index/255765 "2020-11-18T21:28:16Z")

</div>

Hi All, we're using Elasticsearch for storing our application logs using daily indexes, which we delete after two weeks. Now we would like to keep all logs with the loglevel "error" for another 2 months. We thought abo…

---

## [Node.processors setting](https://discuss.elastic.co/t/node-processors-setting/255879)

<div class="topic-metadata">

**Author:** [@wazzu62](https://discuss.elastic.co/u/wazzu62)\
**Replies:** 1\
**Last updated:** [November 18, 2020, 9:27pm UTC](https://discuss.elastic.co/t/node-processors-setting/255879 "2020-11-18T21:27:12Z")

</div>

I have an ES cluster running 7.4.2. 14 physical servers, 37 ES nodes. Some of the servers run 2 ES nodes, some run 3 ES nodes. Would like to use the node-processor setting. The servers have 48 processors in them. T…

---

## [Transform date to ELK](https://discuss.elastic.co/t/transform-date-to-elk/255878)

<div class="topic-metadata">

**Author:** [@Matias\_Aguero\_Escoba](https://discuss.elastic.co/u/Matias_Aguero_Escoba)\
**Replies:** 1\
**Last updated:** [November 18, 2020, 9:26pm UTC](https://discuss.elastic.co/t/transform-date-to-elk/255878 "2020-11-18T21:26:20Z")

</div>

Hi everyone! my name is Matias Aguero, I need to transform a date value field with the format "2019-08-23 17:28:22 UTC" through a logstash pipeline to the format "2020-10-22T14:42:10". how i do this? Thanks!

---

## [Watcher to notify if only last snapshot failed](https://discuss.elastic.co/t/watcher-to-notify-if-only-last-snapshot-failed/255891)

<div class="topic-metadata">

**Author:** [@mwise29](https://discuss.elastic.co/u/mwise29)\
**Replies:** 2\
**Last updated:** [November 18, 2020, 9:18pm UTC](https://discuss.elastic.co/t/watcher-to-notify-if-only-last-snapshot-failed/255891 "2020-11-18T21:18:16Z")

</div>

I'm new to ElasticSearch and trying to setup a monitoring watch that would email me if the status of the last snapshot has failed. I've seen examples in the forums where they looked at the output for a /\_snapshot/repo/\_…

---

## [Date aggregation query based out of a range](https://discuss.elastic.co/t/date-aggregation-query-based-out-of-a-range/255895)

<div class="topic-metadata">

**Author:** [@Alok\_Ranjan](https://discuss.elastic.co/u/Alok_Ranjan)\
**Replies:** 0\
**Last updated:** [November 18, 2020, 8:15pm UTC](https://discuss.elastic.co/t/date-aggregation-query-based-out-of-a-range/255895 "2020-11-18T20:15:13Z")

</div>

Hi All, I have a simple requirement to get the aggregated result as per the posted date like documents posted any day, today, less than 7 days, less than 30 days, or greater than 30 days. I wrote a simple date range qu…

---

## [Pipeline to Pipelines configuration](https://discuss.elastic.co/t/pipeline-to-pipelines-configuration/255343)

<div class="topic-metadata">

**Author:** [@Alexandros888](https://discuss.elastic.co/u/Alexandros888)\
**Replies:** 3\
**Last updated:** [November 18, 2020, 8:11pm UTC](https://discuss.elastic.co/t/pipeline-to-pipelines-configuration/255343 "2020-11-18T20:11:11Z")

</div>

Hello, I want to use the pipeline to pipeline communication in pipeline creation in kibana, But i want the same input to send to 2 different pipelines. My code is the following but doesn't seem to work. input { be…

---

## [Java High Level Client Nodes Info API](https://discuss.elastic.co/t/java-high-level-client-nodes-info-api/255885)

<div class="topic-metadata">

**Author:** [@tberne](https://discuss.elastic.co/u/tberne)\
**Replies:** 2\
**Last updated:** [November 18, 2020, 7:43pm UTC](https://discuss.elastic.co/t/java-high-level-client-nodes-info-api/255885 "2020-11-18T19:43:57Z")

</div>

Hi! I'm in a process of migration between Java Transport Client and Java High Level Client. Transport client had a nodesInfo API (we used client.admin().cluster().prepareNodesInfo().execute().get().getNodes() to be mor…

---

## [ElasticSearch Optimizing questions](https://discuss.elastic.co/t/elasticsearch-optimizing-questions/253233)

<div class="topic-metadata">

**Author:** [@Joran](https://discuss.elastic.co/u/Joran)\
**Replies:** 4\
**Last updated:** [November 18, 2020, 6:30pm UTC](https://discuss.elastic.co/t/elasticsearch-optimizing-questions/253233 "2020-11-18T18:30:13Z")

</div>

Just a heads-up, this is the first time I post something on this forum. I'm a data scientist working at a start-up and we use elasticsearch to store, and query our data. We have used ES with much success over the last y…

---

## [Kibana canvas change column width](https://discuss.elastic.co/t/kibana-canvas-change-column-width/255101)

<div class="topic-metadata">

**Author:** [@Carlos\_Fernando\_Palm](https://discuss.elastic.co/u/Carlos_Fernando_Palm)\
**Replies:** 4\
**Last updated:** [November 18, 2020, 6:12pm UTC](https://discuss.elastic.co/t/kibana-canvas-change-column-width/255101 "2020-11-18T18:12:03Z")

</div>

Hello there. I am trying to change the width of a column in kibana. The thing is that when I set column count to something other than 1 here : I end up with something like this: Looks like in fact all we have is …

---

## [Metricbeat 7.9.2 service doesn't start on windows 2019, but fine on linux](https://discuss.elastic.co/t/metricbeat-7-9-2-service-doesnt-start-on-windows-2019-but-fine-on-linux/253054)

<div class="topic-metadata">

**Author:** [@jmacnett](https://discuss.elastic.co/u/jmacnett)\
**Replies:** 18\
**Last updated:** [November 18, 2020, 5:14pm UTC](https://discuss.elastic.co/t/metricbeat-7-9-2-service-doesnt-start-on-windows-2019-but-fine-on-linux/253054 "2020-11-18T17:14:18Z")

</div>

Attempting a new setup of Metricbeat on a fresh windows 2019 server, and getting error 1067 ("The process terminated unsuccessfully) from services.msc. Powershell startup is essentially the same result. Setup: The fi…

---

## [Kibana can't open through nginx](https://discuss.elastic.co/t/kibana-cant-open-through-nginx/255335)

<div class="topic-metadata">

**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\
**Replies:** 12\
**Last updated:** [November 18, 2020, 4:47pm UTC](https://discuss.elastic.co/t/kibana-cant-open-through-nginx/255335 "2020-11-18T16:47:56Z")

</div>

I am using elk stack 7.9 with xpack-security. When i dont use nginx it works properly( a login page comes up of kibana).When i use nginx.. i provide the user name and password of nginx but kibana page doesn't open.. i …

---

## [Unable to log into Kibana after first time setup of xpack.security.enabled](https://discuss.elastic.co/t/unable-to-log-into-kibana-after-first-time-setup-of-xpack-security-enabled/255759)

<div class="topic-metadata">

**Author:** [@dmaclennan](https://discuss.elastic.co/u/dmaclennan)\
**Replies:** 7\
**Last updated:** [November 18, 2020, 4:43pm UTC](https://discuss.elastic.co/t/unable-to-log-into-kibana-after-first-time-setup-of-xpack-security-enabled/255759 "2020-11-18T16:43:44Z")

</div>

Finding myself at a bit of a hault on my ELK stack setup. I've setup kibana, elasticsearch and logstash on a Centos VM and have everything working great prior to introducing xpack.security.enabled for user authenticatio…

---

## [Invalid index name \[\_all\], must not start with '\_'\]](https://discuss.elastic.co/t/invalid-index-name-all-must-not-start-with/255808)

<div class="topic-metadata">

**Author:** [@lankin1](https://discuss.elastic.co/u/lankin1)\
**Replies:** 1\
**Last updated:** [November 18, 2020, 4:35pm UTC](https://discuss.elastic.co/t/invalid-index-name-all-must-not-start-with/255808 "2020-11-18T16:35:00Z")

</div>

Hi all, When I try to delete all documents by id: POST /\_all/\_delete\_by\_query {"query": {"match": {"id":"xxxxxxxx"} }} I get the following error: 400 Bad Request: \[{"error":"RemoteTransportException\[\[Launch\_001\]\[inet…

---

## [Script after kibana initialization](https://discuss.elastic.co/t/script-after-kibana-initialization/255722)

<div class="topic-metadata">

**Author:** [@Carlos\_Fernando\_Palm](https://discuss.elastic.co/u/Carlos_Fernando_Palm)\
**Replies:** 1\
**Last updated:** [November 18, 2020, 4:21pm UTC](https://discuss.elastic.co/t/script-after-kibana-initialization/255722 "2020-11-18T16:21:12Z")

</div>

Hello. I have created a canvas and would like to make sure anyone using my docker-compose file has it as soon as the ELK stack initializes. For that purpose I wrote the following script: #!/bin/bash response=$(curl -s…

---

## [\[Logstash\] Insufficient memory for the Java Runtime Environment to continue](https://discuss.elastic.co/t/logstash-insufficient-memory-for-the-java-runtime-environment-to-continue/255084)

<div class="topic-metadata">

**Author:** [@Albertoares](https://discuss.elastic.co/u/Albertoares)\
**Replies:** 3\
**Last updated:** [November 18, 2020, 3:53pm UTC](https://discuss.elastic.co/t/logstash-insufficient-memory-for-the-java-runtime-environment-to-continue/255084 "2020-11-18T15:53:06Z")

</div>

Hi everyone, I have a hard time with logstash service. My server was set up to send filebeat to a kafka server and everything was fine until yesterday where I had the following error when debugging logstash: \` OpenJDK …

---

## [ES 7.10 shows an error when using aws module in filebeat](https://discuss.elastic.co/t/es-7-10-shows-an-error-when-using-aws-module-in-filebeat/255647)

<div class="topic-metadata">

**Author:** [@Edwin.v](https://discuss.elastic.co/u/Edwin.v)\
**Replies:** 2\
**Last updated:** [November 18, 2020, 3:36pm UTC](https://discuss.elastic.co/t/es-7-10-shows-an-error-when-using-aws-module-in-filebeat/255647 "2020-11-18T15:36:48Z")

</div>

Elasticsearch 7.9.3 was working fine when I updated to version 7.10 . It is showing an error cfgfile/list.go:99 Error creating runner from config: Error getting config for fileset aws/s3access: Error interpreting…

---

## [ElasticSearch: RestHighLevelClient is getting timeout exception if client API is idle for some time](https://discuss.elastic.co/t/elasticsearch-resthighlevelclient-is-getting-timeout-exception-if-client-api-is-idle-for-some-time/255442)

<div class="topic-metadata">

**Author:** [@john\_jayaraj](https://discuss.elastic.co/u/john_jayaraj)\
**Replies:** 7\
**Last updated:** [November 18, 2020, 3:32pm UTC](https://discuss.elastic.co/t/elasticsearch-resthighlevelclient-is-getting-timeout-exception-if-client-api-is-idle-for-some-time/255442 "2020-11-18T15:32:45Z")

</div>

I have an REST API with spring boot and RestHighLevelClient to retrieve data from ELasticSearch(AWS-ElasticSearch) and this client API is deployed in OpenShift Container. normally this client API will respond back with…

---

## [Best ways to get into the code of elasticsearch?](https://discuss.elastic.co/t/best-ways-to-get-into-the-code-of-elasticsearch/255844)

<div class="topic-metadata">

**Author:** [@qohelet](https://discuss.elastic.co/u/qohelet)\
**Replies:** 1\
**Last updated:** [November 18, 2020, 3:31pm UTC](https://discuss.elastic.co/t/best-ways-to-get-into-the-code-of-elasticsearch/255844 "2020-11-18T15:31:55Z")

</div>

I'm a FOSS-enthusiast and started to fiddle around with elasticsearch. I like the implementation and the possibilities on how to set up the queries. Despite developing Java for quite a while I haven't worked with Gradl…

[Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1688)

[Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1690)
