# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1691 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1692 --- ## [Correct syntax for adding a filter aggregation in a Kibana visualization as a JSON input (filtering for a specific property value)](https://discuss.elastic.co/t/correct-syntax-for-adding-a-filter-aggregation-in-a-kibana-visualization-as-a-json-input-filtering-for-a-specific-property-value/255638)
**Author:** [@rputla](https://discuss.elastic.co/u/rputla)\ **Replies:** 2\ **Last updated:** [November 18, 2020, 7:16am UTC](https://discuss.elastic.co/t/correct-syntax-for-adding-a-filter-aggregation-in-a-kibana-visualization-as-a-json-input-filtering-for-a-specific-property-value/255638 "2020-11-18T07:16:37Z")
Hi all, I am new to ELK stack. can you please help me with below requirement. I am trying to create a metric based on condition like sum( sales) for region ="Middle East" I have tried using the sum bucket in aggregati… --- ## [How to add additional fields on filebeat](https://discuss.elastic.co/t/how-to-add-additional-fields-on-filebeat/255489)
**Author:** [@elkrocks](https://discuss.elastic.co/u/elkrocks)\ **Replies:** 2\ **Last updated:** [November 18, 2020, 7:09am UTC](https://discuss.elastic.co/t/how-to-add-additional-fields-on-filebeat/255489 "2020-11-18T07:09:32Z")
I want to add additional field on filebeat.yml. I want to name it as instancename and the value is the instance name of my aws ec2 instance. How can I add it to the filebeat config? --- ## [Packetbeat nfs resulting in heavy memory usage](https://discuss.elastic.co/t/packetbeat-nfs-resulting-in-heavy-memory-usage/254514)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 1\ **Last updated:** [November 18, 2020, 7:05am UTC](https://discuss.elastic.co/t/packetbeat-nfs-resulting-in-heavy-memory-usage/254514 "2020-11-18T07:05:13Z")
Hello, We are noticing heavy memory usage by Packetbeat, which seems to be related to the nfs protocol. The server on which this is happening is an ftp server and runs jobs at night where incoming ftp is moved to nfs sh… --- ## [Create pipeline for module](https://discuss.elastic.co/t/create-pipeline-for-module/255651)
**Author:** [@headtea](https://discuss.elastic.co/u/headtea)\ **Replies:** 2\ **Last updated:** [November 18, 2020, 6:52am UTC](https://discuss.elastic.co/t/create-pipeline-for-module/255651 "2020-11-18T06:52:33Z")
I've enabled the filebeat system module: filebeat modules enable system filebeat setup --pipelines --modules system filebeat setup --dashboards systemctl restart filebeat This is what logstash has to say pipeline with… --- ## [Filebeat OSS 7.7.0 not able to connect AWS Elasticsearch Service 7.7.0](https://discuss.elastic.co/t/filebeat-oss-7-7-0-not-able-to-connect-aws-elasticsearch-service-7-7-0/252275)
**Author:** [@Jigar\_Patel1](https://discuss.elastic.co/u/Jigar_Patel1)\ **Replies:** 5\ **Last updated:** [November 18, 2020, 6:30am UTC](https://discuss.elastic.co/t/filebeat-oss-7-7-0-not-able-to-connect-aws-elasticsearch-service-7-7-0/252275 "2020-11-18T06:30:54Z")
I am using EC2 VM to send logs to AWS Elasticsearch Service 7.7.0. EC2 instance and Elastic Service can communicate via same VPC. But, filebeat OSS 7.7.0 not able to connect to Elasticsearch service 7.7.0. Any suggestin… --- ## [Need to recreate/reindex when upgrading beats?](https://discuss.elastic.co/t/need-to-recreate-reindex-when-upgrading-beats/255783)
**Author:** [@rgeisman](https://discuss.elastic.co/u/rgeisman)\ **Replies:** 2\ **Last updated:** [November 18, 2020, 6:29am UTC](https://discuss.elastic.co/t/need-to-recreate-reindex-when-upgrading-beats/255783 "2020-11-18T06:29:46Z")
Greetings all. I have some questions in general about when beats upgrade. We have ELK running on a cluster where an orchestration platform upgrades the beats automatically. So using Logstash of course when I first use… --- ## [Index 350MB of file content using ingest attachment pipiline Elastic.Net throws System.OutOfMemory Exception](https://discuss.elastic.co/t/index-350mb-of-file-content-using-ingest-attachment-pipiline-elastic-net-throws-system-outofmemory-exception/255620)
**Author:** [@kiet.tran](https://discuss.elastic.co/u/kiet.tran)\ **Replies:** 3\ **Last updated:** [November 18, 2020, 6:26am UTC](https://discuss.elastic.co/t/index-350mb-of-file-content-using-ingest-attachment-pipiline-elastic-net-throws-system-outofmemory-exception/255620 "2020-11-18T06:26:34Z")
Hi There, hope you all well. Our setup: our program on dotnet full framework using NEST 7.9 and elastic search 7.9. Changed elasticsearch.yml http.max\_content\_length: 1000mb and using plugin ingest attachment for parsi… --- ## [Need to search for messages containing angle bracket (\<)](https://discuss.elastic.co/t/need-to-search-for-messages-containing-angle-bracket/255706)
**Author:** [@naveen\_wilson](https://discuss.elastic.co/u/naveen_wilson)\ **Replies:** 2\ **Last updated:** [November 18, 2020, 4:32am UTC](https://discuss.elastic.co/t/need-to-search-for-messages-containing-angle-bracket/255706 "2020-11-18T04:32:44Z")
In Kibana logs, the xml feeds are printing line by line which makes it hard to check the logs. So i would want to search for the log entries having angle bracket to get the xml lines together. I tried with the below que… --- ## [Max requests per Keep-Alive Connection](https://discuss.elastic.co/t/max-requests-per-keep-alive-connection/255586)
**Author:** [@Vish\_M](https://discuss.elastic.co/u/Vish_M)\ **Replies:** 2\ **Last updated:** [November 18, 2020, 3:41am UTC](https://discuss.elastic.co/t/max-requests-per-keep-alive-connection/255586 "2020-11-18T03:41:03Z")
Hello, How can I set the max number of requests that a Keep-Alive Connection can serve before it is closed. I am looking to set the max parameter here. Any pointers in this regard is much appreciated. --- ## [Disable specific roles for a node in 7.X+](https://discuss.elastic.co/t/disable-specific-roles-for-a-node-in-7-x/255779)
**Author:** [@Dennis1](https://discuss.elastic.co/u/Dennis1)\ **Replies:** 0\ **Last updated:** [November 18, 2020, 3:15am UTC](https://discuss.elastic.co/t/disable-specific-roles-for-a-node-in-7-x/255779 "2020-11-18T03:15:51Z")
Hello, I noticed that the manner for enabling specific roles for nodes changed between Elasticsearch versions 6.X and 7.X, and am wondering what is the new way to disable specific roles for nodes? In particular, the doc… --- ## [How to calculate the query per second from the existing metrics?](https://discuss.elastic.co/t/how-to-calculate-the-query-per-second-from-the-existing-metrics/255775)
**Author:** [@Izek\_Chen](https://discuss.elastic.co/u/Izek_Chen)\ **Replies:** 0\ **Last updated:** [November 18, 2020, 2:39am UTC](https://discuss.elastic.co/t/how-to-calculate-the-query-per-second-from-the-existing-metrics/255775 "2020-11-18T02:39:30Z")
As per title, I check the export field document and seems like the "mongodb.collstats.queries.time.us" is the right one. the problem I see is that since the metrics gathered are cumulative those values do not represent … --- ## [ElasticSearch master and slaves](https://discuss.elastic.co/t/elasticsearch-master-and-slaves/255735)
**Author:** [@Dzyann](https://discuss.elastic.co/u/Dzyann)\ **Replies:** 6\ **Last updated:** [November 18, 2020, 12:58am UTC](https://discuss.elastic.co/t/elasticsearch-master-and-slaves/255735 "2020-11-18T00:58:13Z")
I don't usually work much with Elastic, I have been reading about Elastic Configuration. It is my understanding that Elastic is designed to run clustered, where several nodes, at least 3, should be master. And there are … --- ## [Difference between Ingest Node and Coordinating Node?](https://discuss.elastic.co/t/difference-between-ingest-node-and-coordinating-node/255753)
**Author:** [@Divit\_Sharma](https://discuss.elastic.co/u/Divit_Sharma)\ **Replies:** 7\ **Last updated:** [November 18, 2020, 12:23am UTC](https://discuss.elastic.co/t/difference-between-ingest-node-and-coordinating-node/255753 "2020-11-18T00:23:18Z")
Do Ingest node apply only to indexing from ingest pipelines? And Coordinating Node to all other kinds of indexing? Also client and Coordinating nodes are same right? --- ## [Upgrade ES 5.6.3 to ES 7.8.0: Slower queries. Trying to explain/find out why](https://discuss.elastic.co/t/upgrade-es-5-6-3-to-es-7-8-0-slower-queries-trying-to-explain-find-out-why/255293)
**Author:** [@pvdp](https://discuss.elastic.co/u/pvdp)\ **Replies:** 2\ **Last updated:** [November 17, 2020, 11:52pm UTC](https://discuss.elastic.co/t/upgrade-es-5-6-3-to-es-7-8-0-slower-queries-trying-to-explain-find-out-why/255293 "2020-11-17T23:52:16Z")
We are upgrading from ES 5.6.3 to ES 7.8.0. As part of this, we are doing performance tests to see if there is an improvement or actual degradation in performance. For this we've setup 2 identical clusters in AWS, each… --- ## [ILM Policy for non writing existing index](https://discuss.elastic.co/t/ilm-policy-for-non-writing-existing-index/255217)
**Author:** [@ksaha](https://discuss.elastic.co/u/ksaha)\ **Replies:** 1\ **Last updated:** [November 17, 2020, 11:20pm UTC](https://discuss.elastic.co/t/ilm-policy-for-non-writing-existing-index/255217 "2020-11-17T23:20:39Z")
Hi, I am exploring ILM in Elasticsearch. I am having one question, can we apply ILM policy to non writing existing index? Thanks. --- ## [Kibana is not ready yet](https://discuss.elastic.co/t/kibana-is-not-ready-yet/255326)
**Author:** [@frederiksf](https://discuss.elastic.co/u/frederiksf)\ **Replies:** 1\ **Last updated:** [November 17, 2020, 11:18pm UTC](https://discuss.elastic.co/t/kibana-is-not-ready-yet/255326 "2020-11-17T23:18:58Z")
We faced this error for at least 24 hours. We think we had no resource issues but we are 100 % sure. I checked out these metrics; root@-0:/# curl https://vpc-es-eu-central-1-prd-xxx.eu-central-1.es.amazonaws.com/\_nodes/… --- ## [Elasticsearch v 7.8.0 issue with disk quota](https://discuss.elastic.co/t/elasticsearch-v-7-8-0-issue-with-disk-quota/255334)
**Author:** [@nipul\_sawant](https://discuss.elastic.co/u/nipul_sawant)\ **Replies:** 2\ **Last updated:** [November 17, 2020, 11:18pm UTC](https://discuss.elastic.co/t/elasticsearch-v-7-8-0-issue-with-disk-quota/255334 "2020-11-17T23:18:27Z")
Elasticsearch v 7.8.0 stop working after hits reached 25GB. Any suggestions ? --- ## [DSL Aggregations: How to get results, even if one of the aggs field is not present?](https://discuss.elastic.co/t/dsl-aggregations-how-to-get-results-even-if-one-of-the-aggs-field-is-not-present/255360)
**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\ **Replies:** 1\ **Last updated:** [November 17, 2020, 11:17pm UTC](https://discuss.elastic.co/t/dsl-aggregations-how-to-get-results-even-if-one-of-the-aggs-field-is-not-present/255360 "2020-11-17T23:17:15Z")
We have to do aggregations for host.os.name, host.name, host.ip 99% data has host.os.name 95% has host.name 25% has host.ip How to ensure I get all the results, even if the field is not present? So i'm looking for … --- ## [Compare two fields and achieve a left outer comparison](https://discuss.elastic.co/t/compare-two-fields-and-achieve-a-left-outer-comparison/255377)
**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\ **Replies:** 1\ **Last updated:** [November 17, 2020, 11:16pm UTC](https://discuss.elastic.co/t/compare-two-fields-and-achieve-a-left-outer-comparison/255377 "2020-11-17T23:16:11Z")
I've following data { "index" : { "\_index" : "host\_compare", "\_id" : "1" } } { "host\_name" : "myhost2" , "host\_count" : "10", "@timestamp": "2020-11-12T02:00:00Z" } { "index" : { "\_index" : "host\_compare", "\_id" : "3" }… --- ## [Multiple pipelines in Logstash](https://discuss.elastic.co/t/multiple-pipelines-in-logstash/255418)
**Author:** [@Cosmin\_Ciobanu1](https://discuss.elastic.co/u/Cosmin_Ciobanu1)\ **Replies:** 1\ **Last updated:** [November 17, 2020, 11:13pm UTC](https://discuss.elastic.co/t/multiple-pipelines-in-logstash/255418 "2020-11-17T23:13:25Z")
Hi! I'm trying to make multiple pipelines and I'm getting those errors every time: \[2020-11-15T00:33:36,799\]\[WARN \]\[org.logstash.execution.ShutdownWatcherExt\] {"inflight\_count"=\>0, "stalling\_threads\_info"=\>{"other"=\>\[{… --- ## [Filebeat reporting stops after index errors](https://discuss.elastic.co/t/filebeat-reporting-stops-after-index-errors/255485)
**Author:** [@CatalinM](https://discuss.elastic.co/u/CatalinM)\ **Replies:** 0\ **Last updated:** [November 16, 2020, 9:44am UTC](https://discuss.elastic.co/t/filebeat-reporting-stops-after-index-errors/255485 "2020-11-16T09:44:29Z")
I've noticed Filebeat stopped sending logs to ES after awhile (seems like some pods are restarting - might be the Jaeger agent with the cleanup jobs start around midnight). It's always caused by an empty index name due t… --- ## [org.elasticsearch.index.mapper.MapperParsingException after a pipeline](https://discuss.elastic.co/t/org-elasticsearch-index-mapper-mapperparsingexception-after-a-pipeline/255484)
**Author:** [@samsalvatico](https://discuss.elastic.co/u/samsalvatico)\ **Replies:** 1\ **Last updated:** [November 17, 2020, 11:10pm UTC](https://discuss.elastic.co/t/org-elasticsearch-index-mapper-mapperparsingexception-after-a-pipeline/255484 "2020-11-17T23:10:46Z")
Hi, this is my scenario: I receive messages by Fluentbit through an elastic ingestion pipeline. This is my ingestion pipeline: { "jsonize\_account\_backend":{ "processors":\[ { "gr… --- ## [Annotate a doc thru Kibana](https://discuss.elastic.co/t/annotate-a-doc-thru-kibana/255561)
**Author:** [@Narendra\_Jain](https://discuss.elastic.co/u/Narendra_Jain)\ **Replies:** 1\ **Last updated:** [November 17, 2020, 10:51pm UTC](https://discuss.elastic.co/t/annotate-a-doc-thru-kibana/255561 "2020-11-17T22:51:05Z")
Hi, Is there a way a Kibana user can annotate a document, eg. a doc show some random value which operation team reason and annotate the doc so next person understand the behavior same for exception log --- ## [Cluster crashed: "Server gave HTTP response to HTTPS client"](https://discuss.elastic.co/t/cluster-crashed-server-gave-http-response-to-https-client/255762)
**Author:** [@realscout](https://discuss.elastic.co/u/realscout)\ **Replies:** 2\ **Last updated:** [November 17, 2020, 10:48pm UTC](https://discuss.elastic.co/t/cluster-crashed-server-gave-http-response-to-https-client/255762 "2020-11-17T22:48:13Z")
Today, our ElasticSearch cluster stopped responding. We were not performing any sort of maintenance or making any changes. Any request to the cluster caused it to respond with: "Get "https://X.X.X.X:X/": http: server g… --- ## [Is Storage Size under Index Management includes replicated data storage size as well?](https://discuss.elastic.co/t/is-storage-size-under-index-management-includes-replicated-data-storage-size-as-well/255662)
**Author:** [@KunwarAkanksha](https://discuss.elastic.co/u/KunwarAkanksha)\ **Replies:** 1\ **Last updated:** [November 17, 2020, 10:45pm UTC](https://discuss.elastic.co/t/is-storage-size-under-index-management-includes-replicated-data-storage-size-as-well/255662 "2020-11-17T22:45:57Z")
I am wondering if the storage size under Index Management is calculated for data and replicated data both. Example if my replication Factor is 2 , then do storage size tells the ( data storage + 2 \* replicated data stor… --- ## [Replacing Elasticsearch Node](https://discuss.elastic.co/t/replacing-elasticsearch-node/255654)
**Author:** [@junydania](https://discuss.elastic.co/u/junydania)\ **Replies:** 1\ **Last updated:** [November 17, 2020, 10:45pm UTC](https://discuss.elastic.co/t/replacing-elasticsearch-node/255654 "2020-11-17T22:45:17Z")
Hello, I have a 3 node elasticsearch cluster running on version 7.6.2 in a container environment. Three nodes used with each container running on unique host machines. Each node in the cluster is both a master and data… --- ## [Assistance with fields and filtering on Elk query](https://discuss.elastic.co/t/assistance-with-fields-and-filtering-on-elk-query/255695)
**Author:** [@douglasnew](https://discuss.elastic.co/u/douglasnew)\ **Replies:** 1\ **Last updated:** [November 17, 2020, 10:39pm UTC](https://discuss.elastic.co/t/assistance-with-fields-and-filtering-on-elk-query/255695 "2020-11-17T22:39:11Z")
HI all. Can someone assist. I am trying to add an additional field to this query but it does not seem to work as expected. I am trying to simply ass the field "message" and filter based on a matched string. Here is my … --- ## [Logstash as daemon won't start](https://discuss.elastic.co/t/logstash-as-daemon-wont-start/255716)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 1\ **Last updated:** [November 17, 2020, 10:05pm UTC](https://discuss.elastic.co/t/logstash-as-daemon-wont-start/255716 "2020-11-17T22:05:25Z")
I just upgraded system to 7.10.0 this is test system. and logstash daemon won't start. here is result of journalctl -xe start-up result is done. Nov 17 08:28:25 elkdev01 logstash\[13918\]: Using bundled JDK: /usr/sha… --- ## [Field "process.command\_line" not popluated even though I can see it in the message field](https://discuss.elastic.co/t/field-process-command-line-not-popluated-even-though-i-can-see-it-in-the-message-field/255589)
**Author:** [@hilo21](https://discuss.elastic.co/u/hilo21)\ **Replies:** 1\ **Last updated:** [November 17, 2020, 9:53pm UTC](https://discuss.elastic.co/t/field-process-command-line-not-popluated-even-though-i-can-see-it-in-the-message-field/255589 "2020-11-17T21:53:12Z")
Hello, I need some orientation with my issue : Description : I have an ELK stack version 7.6 that collects event logs from different log sources via logstash. All endpoints (windows ends linux) send logs to logstash t… --- ## [Winlogbeat Deployment with SCCM](https://discuss.elastic.co/t/winlogbeat-deployment-with-sccm/255760)
**Author:** [@atomiczombie79](https://discuss.elastic.co/u/atomiczombie79)\ **Replies:** 0\ **Last updated:** [November 17, 2020, 8:59pm UTC](https://discuss.elastic.co/t/winlogbeat-deployment-with-sccm/255760 "2020-11-17T20:59:08Z")
Does anyone have any experience building out an SCCM package for Winlogbeat? Our Security team would like to use Winlogbeat and Sysmon to monitor the environment and I would like to be able to deploy using SCCM. I curr… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1690) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1692)