# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1732 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1733 --- ## [How to give priority to exact search in multiple should match?](https://discuss.elastic.co/t/how-to-give-priority-to-exact-search-in-multiple-should-match/253300)
**Author:** [@darshan\_ambre](https://discuss.elastic.co/u/darshan_ambre)\ **Replies:** 0\ **Last updated:** [October 26, 2020, 11:54am UTC](https://discuss.elastic.co/t/how-to-give-priority-to-exact-search-in-multiple-should-match/253300 "2020-10-26T11:54:57Z")
How to return only exact match if exists else perform wildcard search. for e.g. for the below given set of data \[ { "\_index" : "priority\_test", "\_type" : "\_doc", "\_id" : "3IkeZHUBYJCjRl… --- ## [CircuitBreakingException: \[parent\] Data too large](https://discuss.elastic.co/t/circuitbreakingexception-parent-data-too-large/253299)
**Author:** [@Grant\_Zietsman](https://discuss.elastic.co/u/Grant_Zietsman)\ **Replies:** 0\ **Last updated:** [October 26, 2020, 11:28am UTC](https://discuss.elastic.co/t/circuitbreakingexception-parent-data-too-large/253299 "2020-10-26T11:28:49Z")
Running into a CircuitBreakingException when doing a restore for Elasticsearch 7.7.1 Based on this issue, I suspect that I can try disabling indices.breaker.total.use\_real\_memory. Alternatively, I can try reducing CMSIn… --- ## [Elasticsearch dead but pid file exists](https://discuss.elastic.co/t/elasticsearch-dead-but-pid-file-exists/252684)
**Author:** [@muthug](https://discuss.elastic.co/u/muthug)\ **Replies:** 3\ **Last updated:** [October 26, 2020, 11:19am UTC](https://discuss.elastic.co/t/elasticsearch-dead-but-pid-file-exists/252684 "2020-10-26T11:19:39Z")
Why it is happening very frequently? is there any thing crashed ? i have removed the dead file from /var/lock/subsys but again and again i am getting this. Elasticsearch dead but pid file exists --- ## [Filebeat too many open files error](https://discuss.elastic.co/t/filebeat-too-many-open-files-error/253289)
**Author:** [@gizem](https://discuss.elastic.co/u/gizem)\ **Replies:** 0\ **Last updated:** [October 26, 2020, 10:43am UTC](https://discuss.elastic.co/t/filebeat-too-many-open-files-error/253289 "2020-10-26T10:43:22Z")
Hi, I get the error when I start the filebeat 2 \> 020-10-26T13:26:14.132+0300 ERROR \[registrar\] registrar/registrar.go:205 Error writing registrar state to statestore: failed in store/get operation on store 'filebeat'… --- ## [When selecting \[Metricbeat System\] ECS Dashboard panel with time today everything shows 0](https://discuss.elastic.co/t/when-selecting-metricbeat-system-ecs-dashboard-panel-with-time-today-everything-shows-0/253153)
**Author:** [@plegault](https://discuss.elastic.co/u/plegault)\ **Replies:** 2\ **Last updated:** [October 26, 2020, 10:25am UTC](https://discuss.elastic.co/t/when-selecting-metricbeat-system-ecs-dashboard-panel-with-time-today-everything-shows-0/253153 "2020-10-26T10:25:18Z")
I'm using metricbeat and dashboard System Navigation \[Metricbeat System\] ECS Dashboard panel: System Navigation \[Metricbeat System\] ECS Under quick select, I select Today and all bars show as 0% for cpu and memory ver… --- ## [Kibana Authentication Accounts](https://discuss.elastic.co/t/kibana-authentication-accounts/253026)
**Author:** [@Craig2188](https://discuss.elastic.co/u/Craig2188)\ **Replies:** 5\ **Last updated:** [October 26, 2020, 9:38am UTC](https://discuss.elastic.co/t/kibana-authentication-accounts/253026 "2020-10-26T09:38:42Z")
Hi, How can I create accounts on Kibana for other people to access it? Currently, it goes straight into the dashboard when browsing to the URL. It is the Basic version so no AD integration possible. Also, if adding thi… --- ## [Filebeat starting error](https://discuss.elastic.co/t/filebeat-starting-error/253208)
**Author:** [@gizem](https://discuss.elastic.co/u/gizem)\ **Replies:** 1\ **Last updated:** [October 26, 2020, 9:33am UTC](https://discuss.elastic.co/t/filebeat-starting-error/253208 "2020-10-26T09:33:24Z")
Hi, I get the error when I start the filebeat. How can I solve this? ERROR instance/beat.go:951 Exiting: Failed to start crawler: starting input failed: Error while initializing input: Can only start an input when all… --- ## [Elasticsearch error](https://discuss.elastic.co/t/elasticsearch-error/253176)
**Author:** [@Akhil2](https://discuss.elastic.co/u/Akhil2)\ **Replies:** 1\ **Last updated:** [October 26, 2020, 9:25am UTC](https://discuss.elastic.co/t/elasticsearch-error/253176 "2020-10-26T09:25:48Z")
Hello there, I have been using ELK 7.9.2 and now I am trying to set up a cluster with ELK 7.9.3. when I run elasticsearch it gives me following errors? \[2020-10-23T11:51:05,352\]\[WARN \]\[o.e.x.m.e.l.LocalExporter\] \[mast… --- ## [Filter/Collapse on multiple fields](https://discuss.elastic.co/t/filter-collapse-on-multiple-fields/252858)
**Author:** [@Turbo-555](https://discuss.elastic.co/u/Turbo-555)\ **Replies:** 2\ **Last updated:** [October 26, 2020, 9:22am UTC](https://discuss.elastic.co/t/filter-collapse-on-multiple-fields/252858 "2020-10-26T09:22:01Z")
Hi all, I'm trying to find documents that have distinct values over 2 separate fields. Documents have \_id, filters.10,filters.20 For Example: 1, f10\_1, f20\_1 2, f10\_1, f20\_1 3, f10\_2, f20\_1 4, f10\_3, … --- ## [Unable to start the elasticsearch as it says "failed to start ElasticSearch"](https://discuss.elastic.co/t/unable-to-start-the-elasticsearch-as-it-says-failed-to-start-elasticsearch/253257)
**Author:** [@aknraj](https://discuss.elastic.co/u/aknraj)\ **Replies:** 1\ **Last updated:** [October 26, 2020, 9:07am UTC](https://discuss.elastic.co/t/unable-to-start-the-elasticsearch-as-it-says-failed-to-start-elasticsearch/253257 "2020-10-26T09:07:12Z")
Hi - I am receiving the following error while starting the elasticsearch, can you please advise if i am missing any step to follow? â elasticsearch.service - Elasticsearch Loaded: loaded (/usr/lib/systemd/system/elasti… --- ## [Context Suggester: FST size estimate (RAM)](https://discuss.elastic.co/t/context-suggester-fst-size-estimate-ram/252642)
**Author:** [@Bhavik92](https://discuss.elastic.co/u/Bhavik92)\ **Replies:** 5\ **Last updated:** [October 26, 2020, 9:03am UTC](https://discuss.elastic.co/t/context-suggester-fst-size-estimate-ram/252642 "2020-10-26T09:03:24Z")
I've heard about the high memory (heap) occupancy in case FST. Is there any thumb rule I can use to calculate the size of FST / heap given the amount of data that'll be fed as input to suggester. Any benchmarking studie… --- ## ["refresh" index as a background task](https://discuss.elastic.co/t/refresh-index-as-a-background-task/253280)
**Author:** [@ebuildy](https://discuss.elastic.co/u/ebuildy)\ **Replies:** 0\ **Last updated:** [October 26, 2020, 9:02am UTC](https://discuss.elastic.co/t/refresh-index-as-a-background-task/253280 "2020-10-26T09:02:05Z")
We have a big index, calling "\_refresh" API take more than 30 secondes and timeout our HTTP client. what about to add a new parameter wait\_for\_completion (like for reindex API), so this possible to run it asynchronously… --- ## [Enrich processor](https://discuss.elastic.co/t/enrich-processor/252987)
**Author:** [@liorg2](https://discuss.elastic.co/u/liorg2)\ **Replies:** 3\ **Last updated:** [October 26, 2020, 8:55am UTC](https://discuss.elastic.co/t/enrich-processor/252987 "2020-10-26T08:55:15Z")
Hello Is it possible to use the enrich processor, with documents from the same index? In addition, when running POST /\_enrich/policy/my-enrich-test-policy/\_execute it creates an index (.enrich....) with all the value… --- ## [Not getting new columns with aggregation](https://discuss.elastic.co/t/not-getting-new-columns-with-aggregation/253273)
**Author:** [@micobarac](https://discuss.elastic.co/u/micobarac)\ **Replies:** 0\ **Last updated:** [October 26, 2020, 8:23am UTC](https://discuss.elastic.co/t/not-getting-new-columns-with-aggregation/253273 "2020-10-26T08:23:24Z")
This is my variation of the Logstash aggregation filter: filter { if !\[messageid\] { drop {} } else if \[program\] == "amavis" and \[message\] =~ /(?i)message\\-id/ { aggregate { task\_id =\> "%{messageid}" … --- ## [Piechart revert customized colors when no data is displayed](https://discuss.elastic.co/t/piechart-revert-customized-colors-when-no-data-is-displayed/252220)
**Author:** [@Paal\_Aaserud](https://discuss.elastic.co/u/Paal_Aaserud)\ **Replies:** 4\ **Last updated:** [October 26, 2020, 8:45am UTC](https://discuss.elastic.co/t/piechart-revert-customized-colors-when-no-data-is-displayed/252220 "2020-10-26T08:45:42Z")
I have created a visualisation with a pie chart and customized the colors and then saved, this works well until I choose a date range that does not return any data. In this case the chart is empty, and when I change the … --- ## [TSVB Timeline partially missing 30min intervals when Interval set to auto](https://discuss.elastic.co/t/tsvb-timeline-partially-missing-30min-intervals-when-interval-set-to-auto/252626)
**Author:** [@isarib](https://discuss.elastic.co/u/isarib)\ **Replies:** 4\ **Last updated:** [October 26, 2020, 8:40am UTC](https://discuss.elastic.co/t/tsvb-timeline-partially-missing-30min-intervals-when-interval-set-to-auto/252626 "2020-10-26T08:40:51Z")
I noticed what may seem like a bug. I have the interval:auto set, and it looks like the TSVB timeline goes partially missing when you Time Pick Last 2-3 Days, as the timeline uses per 30min intervals. If you Time Pick … --- ## [Grok proccessor UI bug](https://discuss.elastic.co/t/grok-proccessor-ui-bug/253200)
**Author:** [@borna\_talebi](https://discuss.elastic.co/u/borna_talebi)\ **Replies:** 5\ **Last updated:** [October 26, 2020, 8:04am UTC](https://discuss.elastic.co/t/grok-proccessor-ui-bug/253200 "2020-10-26T08:04:07Z")
HI, I'm trying a very simple grok pattern and in Grok Debugger it works fine: But when I tried the same pattern in ingest pipeline I got this "Bad String" Error: Any idea why? I'm using ELK 7.9.2 --- ## [org.logstash.beats.InvalidFrameProtocolException: Invalid version of beats protocol: 34](https://discuss.elastic.co/t/org-logstash-beats-invalidframeprotocolexception-invalid-version-of-beats-protocol-34/253267)
**Author:** [@tuawow](https://discuss.elastic.co/u/tuawow)\ **Replies:** 1\ **Last updated:** [October 26, 2020, 7:23am UTC](https://discuss.elastic.co/t/org-logstash-beats-invalidframeprotocolexception-invalid-version-of-beats-protocol-34/253267 "2020-10-26T07:23:43Z")
\]\[io.netty.channel.DefaultChannelPipeline\]\[main\]\[f73510d0a1046ae249c9c684ab7752f124dc9801416a7a8bc674b1874ca37218\] An exceptionCaught() event was fired, and it reached at the tail of the pipeline. It usually means the la… --- ## [How to build a custom query endpoint against Elastic in an Open API?](https://discuss.elastic.co/t/how-to-build-a-custom-query-endpoint-against-elastic-in-an-open-api/253263)
**Author:** [@Elasticjerk](https://discuss.elastic.co/u/Elasticjerk)\ **Replies:** 0\ **Last updated:** [October 26, 2020, 6:57am UTC](https://discuss.elastic.co/t/how-to-build-a-custom-query-endpoint-against-elastic-in-an-open-api/253263 "2020-10-26T06:57:45Z")
Hi! Im hoping to find inspiration, tips or examples on how to open up more possibilities for independent devs and other organisations using our data. We are running an open API for ad search based on Elastic and would … --- ## [Incorrect query analyzing that don't correspond to the search\_analyzer setting](https://discuss.elastic.co/t/incorrect-query-analyzing-that-dont-correspond-to-the-search-analyzer-setting/253256)
**Author:** [@Alex\_Pravdin](https://discuss.elastic.co/u/Alex_Pravdin)\ **Replies:** 0\ **Last updated:** [October 26, 2020, 3:06am UTC](https://discuss.elastic.co/t/incorrect-query-analyzing-that-dont-correspond-to-the-search-analyzer-setting/253256 "2020-10-26T03:06:54Z")
I'm trying to transform search query against a field replacing parentheses by underscores making them regular letters available for search. The same process is made both for index and for the query. I expect that my quer… --- ## [How to disable task manager](https://discuss.elastic.co/t/how-to-disable-task-manager/252763)
**Author:** [@praveenmak](https://discuss.elastic.co/u/praveenmak)\ **Replies:** 2\ **Last updated:** [October 26, 2020, 2:22am UTC](https://discuss.elastic.co/t/how-to-disable-task-manager/252763 "2020-10-26T02:22:33Z")
Hi, I am seeing lot of these logs in kibana.logs. Its failing authentication and I don't know from where these requests are coming into Kibana. I believe its from Task manager. Does anyone know how to disable Task ma… --- ## [What is the purpose of ingest node?](https://discuss.elastic.co/t/what-is-the-purpose-of-ingest-node/253230)
**Author:** [@Burga](https://discuss.elastic.co/u/Burga)\ **Replies:** 2\ **Last updated:** [October 25, 2020, 10:05pm UTC](https://discuss.elastic.co/t/what-is-the-purpose-of-ingest-node/253230 "2020-10-25T22:05:45Z")
What is the purpose of ingest node ? Thanks in advance. --- ## [Elasticsearch ECK : Kubernetes deployment via default settings showing error](https://discuss.elastic.co/t/elasticsearch-eck-kubernetes-deployment-via-default-settings-showing-error/253231)
**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\ **Replies:** 2\ **Last updated:** [October 25, 2020, 8:26pm UTC](https://discuss.elastic.co/t/elasticsearch-eck-kubernetes-deployment-via-default-settings-showing-error/253231 "2020-10-25T20:26:05Z")
I was following as per quickstart summary of : https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-deploy-elasticsearch.html But when i start , I'm getting below error 0/1 nodes are available: 1 Insufficient memor… --- ## [Map issue on kibana 7.9 and elasticsearch 7.9](https://discuss.elastic.co/t/map-issue-on-kibana-7-9-and-elasticsearch-7-9/253222)
**Author:** [@asma1\_11](https://discuss.elastic.co/u/asma1_11)\ **Replies:** 1\ **Last updated:** [October 25, 2020, 6:53pm UTC](https://discuss.elastic.co/t/map-issue-on-kibana-7-9-and-elasticsearch-7-9/253222 "2020-10-25T18:53:15Z")
Hello All, I have this issue when I tried to visualize map on Elasticsearch 7.9 "Elasticsearch request failed, bad request " I also make sure that the index contains geo\_point location when i run this command GET p… --- ## [Does the field used in field\_value\_factor function scoring need to be an 'indexed' field, or can it just be 'stored'?](https://discuss.elastic.co/t/does-the-field-used-in-field-value-factor-function-scoring-need-to-be-an-indexed-field-or-can-it-just-be-stored/253244)
**Author:** [@jbalakrishnan](https://discuss.elastic.co/u/jbalakrishnan)\ **Replies:** 0\ **Last updated:** [October 25, 2020, 6:06pm UTC](https://discuss.elastic.co/t/does-the-field-used-in-field-value-factor-function-scoring-need-to-be-an-indexed-field-or-can-it-just-be-stored/253244 "2020-10-25T18:06:49Z")
I need to use a positive-valued float or double value field, one field value per document, that I compute at index time. I want to use this value to boost the score of each document matching an arbitrary query, by the va… --- ## [Logstash Ruby not handling float value correctly](https://discuss.elastic.co/t/logstash-ruby-not-handling-float-value-correctly/253150)
**Author:** [@mastersmit](https://discuss.elastic.co/u/mastersmit)\ **Replies:** 6\ **Last updated:** [October 25, 2020, 3:31pm UTC](https://discuss.elastic.co/t/logstash-ruby-not-handling-float-value-correctly/253150 "2020-10-25T15:31:07Z")
I have Kafak \<\> Logstash (then Ruby) \<\> Elastic Kafak Input: {"customerid":"smit","last\_name":"shah","age":10,"height":10,"weight":100,"automated\_email":false, "header": { "endpoint":"/pay"}, "transaction": { "amount":… --- ## [ES 7.5 - Enhancing indexing process](https://discuss.elastic.co/t/es-7-5-enhancing-indexing-process/253238)
**Author:** [@Khalil\_Jomaa](https://discuss.elastic.co/u/Khalil_Jomaa)\ **Replies:** 2\ **Last updated:** [October 25, 2020, 2:25pm UTC](https://discuss.elastic.co/t/es-7-5-enhancing-indexing-process/253238 "2020-10-25T14:25:56Z")
Hello, We are working to enhance our indexing process using ES version 7.5.2 and looking to create a dedicated cluster for doing the test, we need some help and advise which parameters and changes we can test, for examp… --- ## [Filebeat Multiline Messages Ingest Pipeline](https://discuss.elastic.co/t/filebeat-multiline-messages-ingest-pipeline/253235)
**Author:** [@Paul\_B](https://discuss.elastic.co/u/Paul_B)\ **Replies:** 0\ **Last updated:** [October 25, 2020, 12:56pm UTC](https://discuss.elastic.co/t/filebeat-multiline-messages-ingest-pipeline/253235 "2020-10-25T12:56:38Z")
I need some help getting a multiline message from Filebeat Autodiscover ingested into ElasticSearch via an Ingest Pipeline. The messages are not correctly rendering in Kibana Discover, example: The raw message (taken… --- ## [A working example of how to import a Wikipedia dump with Logstash using es\_bulk](https://discuss.elastic.co/t/a-working-example-of-how-to-import-a-wikipedia-dump-with-logstash-using-es-bulk/253228)
**Author:** [@Ola\_Gustafsson1](https://discuss.elastic.co/u/Ola_Gustafsson1)\ **Replies:** 0\ **Last updated:** [October 25, 2020, 9:46am UTC](https://discuss.elastic.co/t/a-working-example-of-how-to-import-a-wikipedia-dump-with-logstash-using-es-bulk/253228 "2020-10-25T09:46:19Z")
I'm writing a logstash configuration file for importing a Wikipedia dump, found on https://dumps.wikimedia.org/other/cirrussearch/current/ The dumps are in the es\_bulk format, ie one line for the action and id of the do… --- ## [Querying sysmon event](https://discuss.elastic.co/t/querying-sysmon-event/252700)
**Author:** [@Yotam\_Mazurik](https://discuss.elastic.co/u/Yotam_Mazurik)\ **Replies:** 1\ **Last updated:** [October 25, 2020, 9:29am UTC](https://discuss.elastic.co/t/querying-sysmon-event/252700 "2020-10-25T09:29:44Z")
Hi, I am new to elk and trying to understand what data modeling to use for my network. what I am trying to achieve is a central databse that will group sysmon data from hosts over my network and querying that dataset t… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1731) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1733)