# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1705 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1706 --- ## [How to reindex after updating a field's ignore\_above attribute](https://discuss.elastic.co/t/how-to-reindex-after-updating-a-fields-ignore-above-attribute/254964)
**Author:** [@pheathers](https://discuss.elastic.co/u/pheathers)\ **Replies:** 2\ **Last updated:** [November 10, 2020, 8:47pm UTC](https://discuss.elastic.co/t/how-to-reindex-after-updating-a-fields-ignore-above-attribute/254964 "2020-11-10T20:47:21Z")
Hi. I have an index created using dynamic mapping with a field set to the default ignore\_above value of 256. I realized that the length is not nearly as high as I would need since the field can have stack traces. I u… --- ## [Using rank and partition in vega-lite](https://discuss.elastic.co/t/using-rank-and-partition-in-vega-lite/254831)
**Author:** [@smruthip](https://discuss.elastic.co/u/smruthip)\ **Replies:** 3\ **Last updated:** [November 10, 2020, 8:32pm UTC](https://discuss.elastic.co/t/using-rank-and-partition-in-vega-lite/254831 "2020-11-10T20:32:47Z")
Hi all, Can we do something like this in vega-lite or any other way in Kibana to display the count and state of the container? Select count(\*), state from ( select container\_id, state, rank() over (partition by co… --- ## [Count licences](https://discuss.elastic.co/t/count-licences/254180)
**Author:** [@jeleb](https://discuss.elastic.co/u/jeleb)\ **Replies:** 3\ **Last updated:** [November 10, 2020, 8:25pm UTC](https://discuss.elastic.co/t/count-licences/254180 "2020-11-10T20:25:41Z")
Hi all, I'm new to ELK I use ELK to parse flexlm log files, and I want to know the number of licenses used simultaneously A flexlm example log file : 22:26:18 (lmgrd) TIMESTAMP 5/22/2013 23:19:37 (MLM) OUT: … --- ## [Log stack freezing After starting API end point](https://discuss.elastic.co/t/log-stack-freezing-after-starting-api-end-point/253618)
**Author:** [@Srini12](https://discuss.elastic.co/u/Srini12)\ **Replies:** 23\ **Last updated:** [November 10, 2020, 8:24pm UTC](https://discuss.elastic.co/t/log-stack-freezing-after-starting-api-end-point/253618 "2020-11-10T20:24:44Z")
Hi Guys I am new to Logstash. I am trying to write small json file to Logstash. It is reading my config etc and freezing after Starting API End Point. No errors showing. Below is my config file; input { file { path… --- ## [CentOS: Failed to start Elasticsearch 7.3.1](https://discuss.elastic.co/t/centos-failed-to-start-elasticsearch-7-3-1/254767)
**Author:** [@obi134](https://discuss.elastic.co/u/obi134)\ **Replies:** 3\ **Last updated:** [November 10, 2020, 7:54pm UTC](https://discuss.elastic.co/t/centos-failed-to-start-elasticsearch-7-3-1/254767 "2020-11-10T19:54:34Z")
Hi there, Some time ago I installed ELKB-Stack on CentOS7. It was running great. Everything was working. Unfortunately it was broken about half a year ago, but I did not got time to look after it earlier. In meantime I… --- ## [Primary & replica shards with different size](https://discuss.elastic.co/t/primary-replica-shards-with-different-size/254849)
**Author:** [@smm](https://discuss.elastic.co/u/smm)\ **Replies:** 3\ **Last updated:** [November 10, 2020, 7:54pm UTC](https://discuss.elastic.co/t/primary-replica-shards-with-different-size/254849 "2020-11-10T19:54:05Z")
Hi there, yesterday I saw that a primary shard and its replica do have a different size. GET /\_cat/shards/dus-log-3v\_mcc\_pp\_dev-6.6.0-2020.42 dus-log-3v\_mcc\_pp\_dev-6.6.0-2020.42 0 p STARTED 29677 35.9mb X.X.X.X node1 … --- ## [Logstash and RabbitMQ input duplicate messages](https://discuss.elastic.co/t/logstash-and-rabbitmq-input-duplicate-messages/254957)
**Author:** [@tomsozolins](https://discuss.elastic.co/u/tomsozolins)\ **Replies:** 7\ **Last updated:** [November 10, 2020, 7:50pm UTC](https://discuss.elastic.co/t/logstash-and-rabbitmq-input-duplicate-messages/254957 "2020-11-10T19:50:07Z")
Hello! I have annoying problem which i am trying to solve for like a week now and i have no idea where to look anymore... ElasticStack 7.9.3 on 3 node cluster (CentOS 7, 3.10.0-1127.19.1.el7.x86\_64). RabbitMQ 3.8.9 E… --- ## [Discover in Kibana show differrent data in Table vs. JSON](https://discuss.elastic.co/t/discover-in-kibana-show-differrent-data-in-table-vs-json/254892)
**Author:** [@Michaela\_Krkosova](https://discuss.elastic.co/u/Michaela_Krkosova)\ **Replies:** 4\ **Last updated:** [November 10, 2020, 7:13pm UTC](https://discuss.elastic.co/t/discover-in-kibana-show-differrent-data-in-table-vs-json/254892 "2020-11-10T19:13:37Z")
Hi there I use ELK Stack 7.2. and when I import data, I Discover in Kibana I see proper data, but in JSON, there is missing letter (Š). I see that Kibana can read it properly. I push data to Elastistack via Logstash (IS… --- ## [Logstash/grok patterns with ECS](https://discuss.elastic.co/t/logstash-grok-patterns-with-ecs/197871)
**Author:** [@prophoto](https://discuss.elastic.co/u/prophoto)\ **Replies:** 11\ **Last updated:** [November 10, 2020, 6:33pm UTC](https://discuss.elastic.co/t/logstash-grok-patterns-with-ecs/197871 "2020-11-10T18:33:10Z")
For a couple weeks I've been attempting to migrate my logs to ECS. I have a running ELK 6.x cluster and it works fine, but my new cluster I want to see if I can get ECS running. I am starting from scratch so old logs don… --- ## [Logstash--jackson-databind vulnerabilities for logstash-7.9.0](https://discuss.elastic.co/t/logstash-jackson-databind-vulnerabilities-for-logstash-7-9-0/254962)
**Author:** [@irfan5189](https://discuss.elastic.co/u/irfan5189)\ **Replies:** 0\ **Last updated:** [November 10, 2020, 6:15pm UTC](https://discuss.elastic.co/t/logstash-jackson-databind-vulnerabilities-for-logstash-7-9-0/254962 "2020-11-10T18:15:57Z")
We found vulnerabilities with logstash version 7.9.0 for jackson-databind. below are the few CVE's for the versions: CVE-2020-24750 CVE-2017-18640 CVE-2020-24616 CVE-2020-14195 CVE-2020-14060 CVE-2020-14062 CVE-2… --- ## [Date\_time\_parse\_exception Warning message in Logstash while fetching data from CSV file](https://discuss.elastic.co/t/date-time-parse-exception-warning-message-in-logstash-while-fetching-data-from-csv-file/254922)
**Author:** [@Pavitra\_Poojary](https://discuss.elastic.co/u/Pavitra_Poojary)\ **Replies:** 5\ **Last updated:** [November 10, 2020, 5:54pm UTC](https://discuss.elastic.co/t/date-time-parse-exception-warning-message-in-logstash-while-fetching-data-from-csv-file/254922 "2020-11-10T17:54:11Z")
Hi, I am trying to fetch data from few csv file input { file { path =\> "/root/API\*" start\_position =\> "beginning" sincedb\_path =\> "/dev/null" type =\> "API" } } filter { csv { separator =\> ",… --- ## [Testing TLS/SSL secured elastic cluster](https://discuss.elastic.co/t/testing-tls-ssl-secured-elastic-cluster/250572)
**Author:** [@dzyubanv](https://discuss.elastic.co/u/dzyubanv)\ **Replies:** 31\ **Last updated:** [November 10, 2020, 5:36pm UTC](https://discuss.elastic.co/t/testing-tls-ssl-secured-elastic-cluster/250572 "2020-11-10T17:36:31Z")
I configured 2 node es cluster with the TLS security section in es yml file using certificates in PKCS#12 format, native realm by default, basic license, elasticsearch-7.8.0-linux-86\_64.tar.gz, RHEL 5.11. Used command w… --- ## [Documents found in scroll, can't be updated?](https://discuss.elastic.co/t/documents-found-in-scroll-cant-be-updated/254956)
**Author:** [@coogle](https://discuss.elastic.co/u/coogle)\ **Replies:** 0\ **Last updated:** [November 10, 2020, 5:36pm UTC](https://discuss.elastic.co/t/documents-found-in-scroll-cant-be-updated/254956 "2020-11-10T17:36:08Z")
Hello, I am using the PHP bindings to do a simple update of an index of about 60k documents via scroll. Basically I am just splitting one field of comma-separated values into two separate lists. I am encountering somet… --- ## [Shard unassigned NODE\_LEFT](https://discuss.elastic.co/t/shard-unassigned-node-left/254955)
**Author:** [@kpiyush](https://discuss.elastic.co/u/kpiyush)\ **Replies:** 0\ **Last updated:** [November 10, 2020, 5:34pm UTC](https://discuss.elastic.co/t/shard-unassigned-node-left/254955 "2020-11-10T17:34:30Z")
Hi, I have restarted the Elsaticsearch worker nodes. After restarting, one of the indexes is stuck on INITIALIZING mode and it is been quite a long time. I ran: curl -k -XGET 'https://eu1.elasticsearch.svc.cluster.loc… --- ## [Forward beats logs from site A to B using a single server as a proxy](https://discuss.elastic.co/t/forward-beats-logs-from-site-a-to-b-using-a-single-server-as-a-proxy/254614)
**Author:** [@Shankars](https://discuss.elastic.co/u/Shankars)\ **Replies:** 3\ **Last updated:** [November 10, 2020, 5:22pm UTC](https://discuss.elastic.co/t/forward-beats-logs-from-site-a-to-b-using-a-single-server-as-a-proxy/254614 "2020-11-10T17:22:49Z")
Hello, I searched a way to ship logs from one site to another using a single point of contact (a server using a VPN to connect to site B), let's see it this way : Differents endpoints using Beats to ship logs to the se… --- ## [Shards rebalance after node leaves cluster](https://discuss.elastic.co/t/shards-rebalance-after-node-leaves-cluster/254930)
**Author:** [@Travis](https://discuss.elastic.co/u/Travis)\ **Replies:** 2\ **Last updated:** [November 10, 2020, 5:10pm UTC](https://discuss.elastic.co/t/shards-rebalance-after-node-leaves-cluster/254930 "2020-11-10T17:10:33Z")
Hello eveybody ! In a 6.8 cluster of 3 hot nodes and 2 cold nodes (with node attribute "Zone" and forced awareness option) : hot\_node1: Zone1 hot\_node2: Zone1 cold\_node\_4: Zone1 / hot\_node3: Zone2 hot\_node5: Zo… --- ## [How to deal with 10MB CSV download size limit?](https://discuss.elastic.co/t/how-to-deal-with-10mb-csv-download-size-limit/254832)
**Author:** [@lchen5](https://discuss.elastic.co/u/lchen5)\ **Replies:** 0\ **Last updated:** [November 10, 2020, 12:55am UTC](https://discuss.elastic.co/t/how-to-deal-with-10mb-csv-download-size-limit/254832 "2020-11-10T00:55:43Z")
We are using elastic.co cloud service, and having issue with the 10MB size limitation for CSV download. Questions. Is there a way to increase the limit for the download operation ? If there is no way to increase the … --- ## [Kibana - What privileges required for Save Search option?](https://discuss.elastic.co/t/kibana-what-privileges-required-for-save-search-option/254952)
**Author:** [@brapnda23](https://discuss.elastic.co/u/brapnda23)\ **Replies:** 2\ **Last updated:** [November 10, 2020, 4:55pm UTC](https://discuss.elastic.co/t/kibana-what-privileges-required-for-save-search-option/254952 "2020-11-10T16:55:50Z")
I am using a basic license. Created a few spaces and assigned folks to those spaces. What least index/cluster privilege I need to enable the Save search option for a user in a particular space. I have already given rep… --- ## [Call Elastic API to get an info on a parameter](https://discuss.elastic.co/t/call-elastic-api-to-get-an-info-on-a-parameter/254762)
**Author:** [@Baptiste\_Orsoni](https://discuss.elastic.co/u/Baptiste_Orsoni)\ **Replies:** 9\ **Last updated:** [November 10, 2020, 4:37pm UTC](https://discuss.elastic.co/t/call-elastic-api-to-get-an-info-on-a-parameter/254762 "2020-11-10T16:37:04Z")
Hello, I would like to use the Elastic Search API in order to get information on a parameter I have in one of my index. In concrete terms, I would like to know if there have been any hits for a particular client . ( pa… --- ## [Less number of active ML Node in anomaly detection jobs](https://discuss.elastic.co/t/less-number-of-active-ml-node-in-anomaly-detection-jobs/254827)
**Author:** [@heric](https://discuss.elastic.co/u/heric)\ **Replies:** 5\ **Last updated:** [November 10, 2020, 4:15pm UTC](https://discuss.elastic.co/t/less-number-of-active-ml-node-in-anomaly-detection-jobs/254827 "2020-11-10T16:15:31Z")
Hi, I have 5 nodes elasticsearch cluster and for all of them i activated ML roles. from GET \_nodes i can see ml role for each of the nodes, however in the anomaly detection jobs i saw only 4 active ML nodes "r… --- ## [Rescoring documents based on Author occurrence](https://discuss.elastic.co/t/rescoring-documents-based-on-author-occurrence/254942)
**Author:** [@Charles\_Lariviere](https://discuss.elastic.co/u/Charles_Lariviere)\ **Replies:** 0\ **Last updated:** [November 10, 2020, 3:59pm UTC](https://discuss.elastic.co/t/rescoring-documents-based-on-author-occurrence/254942 "2020-11-10T15:59:59Z")
Hey! We have an index with documents that look like so: { "id": "1", "author\_id": "8", "popularity": 2.5, "tags": \["illustration", "book", "image"\] } We search this index for documents matching given t… --- ## [How to handle nonexistent index in Logstash Elasticsearch filter](https://discuss.elastic.co/t/how-to-handle-nonexistent-index-in-logstash-elasticsearch-filter/254938)
**Author:** [@egray](https://discuss.elastic.co/u/egray)\ **Replies:** 0\ **Last updated:** [November 10, 2020, 3:46pm UTC](https://discuss.elastic.co/t/how-to-handle-nonexistent-index-in-logstash-elasticsearch-filter/254938 "2020-11-10T15:46:10Z")
Hi, I'm getting the exception Failed to query elasticsearch for previous event in Logstash when I use the Elasticsearch filter plugin, because index is dynamic and I can't guarantee that it exists. I could do this with … --- ## [Joinaggregate and argmax() using transform](https://discuss.elastic.co/t/joinaggregate-and-argmax-using-transform/254853)
**Author:** [@smruthip](https://discuss.elastic.co/u/smruthip)\ **Replies:** 1\ **Last updated:** [November 10, 2020, 3:43pm UTC](https://discuss.elastic.co/t/joinaggregate-and-argmax-using-transform/254853 "2020-11-10T15:43:12Z")
Hi, I am trying to display the count of container for each state example: container\_id, container\_state, timestamp 1, loaded, 2pm 1, received, 4pm here the count of container\_id 1 should be only for received state … --- ## [Find static list of phrases in 32M ES index](https://discuss.elastic.co/t/find-static-list-of-phrases-in-32m-es-index/254924)
**Author:** [@mexekanez](https://discuss.elastic.co/u/mexekanez)\ **Replies:** 0\ **Last updated:** [November 10, 2020, 3:04pm UTC](https://discuss.elastic.co/t/find-static-list-of-phrases-in-32m-es-index/254924 "2020-11-10T15:04:21Z")
SO I have a list of 140K records, how do perform a fast search in an index of 32M records? @elasticsearch Appreciate any suggest thanks --- ## [Mutate documentation error](https://discuss.elastic.co/t/mutate-documentation-error/254917)
**Author:** [@gyterpena](https://discuss.elastic.co/u/gyterpena)\ **Replies:** 1\ **Last updated:** [November 10, 2020, 3:34pm UTC](https://discuss.elastic.co/t/mutate-documentation-error/254917 "2020-11-10T15:34:41Z")
Mistake in documentation In above image mutate rename example differs with --- ## [\_grokparsingfailure with Cisco Catalyst switch syslogs](https://discuss.elastic.co/t/grokparsingfailure-with-cisco-catalyst-switch-syslogs/254932)
**Author:** [@Christer\_Palmen](https://discuss.elastic.co/u/Christer_Palmen)\ **Replies:** 0\ **Last updated:** [November 10, 2020, 3:21pm UTC](https://discuss.elastic.co/t/grokparsingfailure-with-cisco-catalyst-switch-syslogs/254932 "2020-11-10T15:21:32Z")
'Hello everybody!' 'I am setting up an Elastic PoC logserver and I am trying to setup Logstash for parsing syslogs from a Cisco switch. Everything is going forward but now I need some help with the filter part of the c… --- ## [CreateJavaVM Failed](https://discuss.elastic.co/t/createjavavm-failed/254928)
**Author:** [@Vitalii\_Kolomiichuk](https://discuss.elastic.co/u/Vitalii_Kolomiichuk)\ **Replies:** 0\ **Last updated:** [November 10, 2020, 3:10pm UTC](https://discuss.elastic.co/t/createjavavm-failed/254928 "2020-11-10T15:10:40Z")
Please help. Can't start elasticsearch service. All configured. JAVA\_HOME in system variables. I tried all solutions that found. Nothing helps. \[2020-11-10 16:28:28\] \[debug\] ( prunsrv.c:1729) \[ 7340\] Commons Daemon pro… --- ## [Number of grok filters per logstash.conf file](https://discuss.elastic.co/t/number-of-grok-filters-per-logstash-conf-file/254914)
**Author:** [@Carlos\_Fernando\_Palm](https://discuss.elastic.co/u/Carlos_Fernando_Palm)\ **Replies:** 7\ **Last updated:** [November 10, 2020, 2:28pm UTC](https://discuss.elastic.co/t/number-of-grok-filters-per-logstash-conf-file/254914 "2020-11-10T14:28:23Z")
Hello everybody. I am trying to parse logs using multiple grok filters. I have noticed that I can use 8 filters so far, each one with its own pattern, like this: grok{ tag\_on\_failure =\> \[\] pattern\_definitions =\> {"… --- ## [Grok regex with or](https://discuss.elastic.co/t/grok-regex-with-or/254815)
**Author:** [@Carlos\_Fernando\_Palm](https://discuss.elastic.co/u/Carlos_Fernando_Palm)\ **Replies:** 4\ **Last updated:** [November 10, 2020, 2:14pm UTC](https://discuss.elastic.co/t/grok-regex-with-or/254815 "2020-11-10T14:14:34Z")
Hello. I am trying to get some info from a message field using regular expressions. Concretely I want to get what's after certain keywords. This is the regex: (?\<="title" :)(.+?)(?=,)|((?\<="description" :)(.+?)(?=,)) N… --- ## [Link two dropdown select visualisations Kibana Canvas](https://discuss.elastic.co/t/link-two-dropdown-select-visualisations-kibana-canvas/253288)
**Author:** [@r97](https://discuss.elastic.co/u/r97)\ **Replies:** 5\ **Last updated:** [November 10, 2020, 2:02pm UTC](https://discuss.elastic.co/t/link-two-dropdown-select-visualisations-kibana-canvas/253288 "2020-11-10T14:02:21Z")
Hi, I've created a canvas with two dropdown selects (One for customer and one for projects) Is there a way to link those, like a parent and child? If I select a customer in the first dropdown select. I want only to see… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1704) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1706)