# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1763 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1764 --- ## [How to change "ignore\_above" property of field in index pattern even index match pattern will be insert in the future?](https://discuss.elastic.co/t/how-to-change-ignore-above-property-of-field-in-index-pattern-even-index-match-pattern-will-be-insert-in-the-future/251208)
**Author:** [@le\_ba\_nam](https://discuss.elastic.co/u/le_ba_nam)\ **Replies:** 5\ **Last updated:** [October 8, 2020, 4:53am UTC](https://discuss.elastic.co/t/how-to-change-ignore-above-property-of-field-in-index-pattern-even-index-match-pattern-will-be-insert-in-the-future/251208 "2020-10-08T04:53:30Z")
I want to change "ignore\_above" property of field in index pattern. I have success with post request like: PUT myIndex-\*/doc/\_mapping { "properties": { "message": { "type": "text", "… --- ## [Auditbeat, Filebeat error: system/socket dataset setup failed: unable to monitor probe p:inet6\_create inet6\_create proto={{.P3}}:s32: perf\_event\_open: too many open files](https://discuss.elastic.co/t/auditbeat-filebeat-error-system-socket-dataset-setup-failed-unable-to-monitor-probe-p-inet6-create-inet6-create-proto-p3-perf-event-open-too-many-open-files/251210)
**Author:** [@bilal\_abudan](https://discuss.elastic.co/u/bilal_abudan)\ **Replies:** 3\ **Last updated:** [October 8, 2020, 4:44am UTC](https://discuss.elastic.co/t/auditbeat-filebeat-error-system-socket-dataset-setup-failed-unable-to-monitor-probe-p-inet6-create-inet6-create-proto-p3-perf-event-open-too-many-open-files/251210 "2020-10-08T04:44:13Z")
Can someone help me please ... ??? i am using Filebeat and Auditbeat, Lets have Auditbeat one, This issue when i started the auditbeat service and theres error below : Exiting: 1 error: system/socket dataset setup fa… --- ## [Logstash memory use keeps increasing linearly over time](https://discuss.elastic.co/t/logstash-memory-use-keeps-increasing-linearly-over-time/250927)
**Author:** [@SHINRA](https://discuss.elastic.co/u/SHINRA)\ **Replies:** 6\ **Last updated:** [October 8, 2020, 4:43am UTC](https://discuss.elastic.co/t/logstash-memory-use-keeps-increasing-linearly-over-time/250927 "2020-10-08T04:43:04Z")
I have a logstash pipelines that runs tasks every day on a fixed time using the http input. Each task completes executing (from input of first pipeline to outputs of the last one) within few minutes. Rest of the day i… --- ## [Basic Auth without SSL](https://discuss.elastic.co/t/basic-auth-without-ssl/251323)
**Author:** [@aaaaahaaaaa](https://discuss.elastic.co/u/aaaaahaaaaa)\ **Replies:** 3\ **Last updated:** [October 8, 2020, 4:25am UTC](https://discuss.elastic.co/t/basic-auth-without-ssl/251323 "2020-10-08T04:25:23Z")
Hi. Is it possible to enable Basic Auth on ES without SSL? I couldn't find that info. We're configuring SSL at the edge of our cluster and enabling SSL beyond that between services is not a requirement for us. --- ## [Elastic Search performance degraded after veriosn update from ES 1.4.2 to ES 7.9](https://discuss.elastic.co/t/elastic-search-performance-degraded-after-veriosn-update-from-es-1-4-2-to-es-7-9/251367)
**Author:** [@GauriA](https://discuss.elastic.co/u/GauriA)\ **Replies:** 0\ **Last updated:** [October 8, 2020, 4:23am UTC](https://discuss.elastic.co/t/elastic-search-performance-degraded-after-veriosn-update-from-es-1-4-2-to-es-7-9/251367 "2020-10-08T04:23:20Z")
We want to upgrade the OLD ES 1.4.2 setup to new ES 7.9. For that we are testing the search performance. I am testing the search performance by querying the search queries returning different no. of documents simultaneou… --- ## [Best way to index user specific products on store index](https://discuss.elastic.co/t/best-way-to-index-user-specific-products-on-store-index/251364)
**Author:** [@roman731](https://discuss.elastic.co/u/roman731)\ **Replies:** 0\ **Last updated:** [October 8, 2020, 3:49am UTC](https://discuss.elastic.co/t/best-way-to-index-user-specific-products-on-store-index/251364 "2020-10-08T03:49:14Z")
I have an index with ~20000 products for an e-commerce website. I would like to implement a "previously purchased feature" for specific users.. so only specific products will return for specific users in this case... but… --- ## [AWS CloudWatch Log Subscription to AWS Elasticsearch Service](https://discuss.elastic.co/t/aws-cloudwatch-log-subscription-to-aws-elasticsearch-service/251363)
**Author:** [@neldreth](https://discuss.elastic.co/u/neldreth)\ **Replies:** 0\ **Last updated:** [October 8, 2020, 3:44am UTC](https://discuss.elastic.co/t/aws-cloudwatch-log-subscription-to-aws-elasticsearch-service/251363 "2020-10-08T03:44:43Z")
For the past couple days I have been trying to identify how to code for an AWS CloudWatch subscription to my ES domain in AWS. My subscription passes into a Lambda function (written in node.js) that POSTs to the endpoint… --- ## [Logstash can't create separate indexes](https://discuss.elastic.co/t/logstash-cant-create-separate-indexes/251270)
**Author:** [@Bhavin\_Varsur](https://discuss.elastic.co/u/Bhavin_Varsur)\ **Replies:** 2\ **Last updated:** [October 8, 2020, 3:31am UTC](https://discuss.elastic.co/t/logstash-cant-create-separate-indexes/251270 "2020-10-08T03:31:32Z")
I have two filebeat inputs which have tags and fields. In my pipeline.conf I used filter logs by theirs tags. but when the time of index create logstash takes index name as a %{\[fields\]\[log\_type\]}-2020-10-07. How can … --- ## [Elasticsearch Engineer 1 - Lab 1.4 - can not find Java](https://discuss.elastic.co/t/elasticsearch-engineer-1-lab-1-4-can-not-find-java/251362)
**Author:** [@justing](https://discuss.elastic.co/u/justing)\ **Replies:** 0\ **Last updated:** [October 8, 2020, 2:31am UTC](https://discuss.elastic.co/t/elasticsearch-engineer-1-lab-1-4-can-not-find-java/251362 "2020-10-08T02:31:08Z")
I’m currently attempting to take ElasticSearch Engineer 1 (On-Demand) training and am stuck at Lab 1.4 in the Lab Environment (Strigo). When attempting to run the logstash command, I get the following error: \[elastic@s… --- ## [Packetbeat not resolving and connecting to kibana in Daemonset](https://discuss.elastic.co/t/packetbeat-not-resolving-and-connecting-to-kibana-in-daemonset/251359)
**Author:** [@MANI\_M](https://discuss.elastic.co/u/MANI_M)\ **Replies:** 0\ **Last updated:** [October 8, 2020, 1:12am UTC](https://discuss.elastic.co/t/packetbeat-not-resolving-and-connecting-to-kibana-in-daemonset/251359 "2020-10-08T01:12:32Z")
With this as reference I created a daemonset for packetbeat. It seems kibana is not getting resolved properly due to which packet beat keeps failing. Here is the packetbeat.yaml file for reference: --- apiVersion: v1 k… --- ## [Bulk loading with different fields for update](https://discuss.elastic.co/t/bulk-loading-with-different-fields-for-update/251350)
**Author:** [@dxunix](https://discuss.elastic.co/u/dxunix)\ **Replies:** 1\ **Last updated:** [October 8, 2020, 12:09am UTC](https://discuss.elastic.co/t/bulk-loading-with-different-fields-for-update/251350 "2020-10-08T00:09:40Z")
So I have a requirement to index some data repeatedly. Each time the data might have different data fields. I want to keep the superset of the fields in the index. I.e. initial load the document like {"\_id": 100, "f… --- ## [Logstash create and reference variables](https://discuss.elastic.co/t/logstash-create-and-reference-variables/251348)
**Author:** [@mohsin106](https://discuss.elastic.co/u/mohsin106)\ **Replies:** 0\ **Last updated:** [October 7, 2020, 10:28pm UTC](https://discuss.elastic.co/t/logstash-create-and-reference-variables/251348 "2020-10-07T22:28:41Z")
Hi, Is there a way to pull and field:value from one event, store it in some sort of variable and then add it to the next event? For example: event1: {device:"router1", in-rate:"1", out-rate:"2", interface:"eth01", des… --- ## [Using "partial" terms aggregation](https://discuss.elastic.co/t/using-partial-terms-aggregation/251347)
**Author:** [@angauber](https://discuss.elastic.co/u/angauber)\ **Replies:** 0\ **Last updated:** [October 7, 2020, 10:24pm UTC](https://discuss.elastic.co/t/using-partial-terms-aggregation/251347 "2020-10-07T22:24:06Z")
I have populate a test index with the following data: /test/\_bulk {"index": {}} {"types": \[1, 2, 4\]} {"index": {}} {"types": \[3\]} {"index": {}} {"types": \[1, 4\]} On that index I'm trying to a build a query where I filt… --- ## [Filebeat installation question?](https://discuss.elastic.co/t/filebeat-installation-question/251140)
**Author:** [@pacy1](https://discuss.elastic.co/u/pacy1)\ **Replies:** 5\ **Last updated:** [October 7, 2020, 10:15pm UTC](https://discuss.elastic.co/t/filebeat-installation-question/251140 "2020-10-07T22:15:40Z")
where to install filebeat, after i finish to installing elsticsearch ,logstash and kibana. how to configure logstash to use log file downloaded. Kindly assist me on this, Thank you in advance --- ## [Dashboard Navigation \[Filebeat Netflow\] not working](https://discuss.elastic.co/t/dashboard-navigation-filebeat-netflow-not-working/249144)
**Author:** [@HelpComputer](https://discuss.elastic.co/u/HelpComputer)\ **Replies:** 12\ **Last updated:** [October 7, 2020, 9:05pm UTC](https://discuss.elastic.co/t/dashboard-navigation-filebeat-netflow-not-working/249144 "2020-10-07T21:05:08Z")
Hello, I recently upgraded our Elastic Stack from 6.8 to 7.9.1 and I am unable to get several Dashboards to work in Kibana. Specifically, the \[Filebeat Netflow\] Overview dashboard. Whenever I select it in Kibana I recei… --- ## [How do I list all of the filebeat clients sending logs to a logstash instance?](https://discuss.elastic.co/t/how-do-i-list-all-of-the-filebeat-clients-sending-logs-to-a-logstash-instance/251297)
**Author:** [@deep9300](https://discuss.elastic.co/u/deep9300)\ **Replies:** 1\ **Last updated:** [October 7, 2020, 8:19pm UTC](https://discuss.elastic.co/t/how-do-i-list-all-of-the-filebeat-clients-sending-logs-to-a-logstash-instance/251297 "2020-10-07T20:19:06Z")
How do I list all of the filebeat clients sending logs to a logstash instance in my ELK cluster (5.6.16)? I want to get a list of these filebeat servers. Is there way to list them in Kibana? Currently if I query "host" i… --- ## [How to create a baseline chart](https://discuss.elastic.co/t/how-to-create-a-baseline-chart/251288)
**Author:** [@WassimDhib](https://discuss.elastic.co/u/WassimDhib)\ **Replies:** 2\ **Last updated:** [October 7, 2020, 8:11pm UTC](https://discuss.elastic.co/t/how-to-create-a-baseline-chart/251288 "2020-10-07T20:11:41Z")
Hi, I have a time series of application performance monitoring data (response times). I need to create a baseline chart ( it is something like mean value plus and minus standard deviation multiplied by some coefficient… --- ## [Aggregate Performing Unpredictably](https://discuss.elastic.co/t/aggregate-performing-unpredictably/251336)
**Author:** [@NomadicCodeGuy](https://discuss.elastic.co/u/NomadicCodeGuy)\ **Replies:** 2\ **Last updated:** [October 7, 2020, 8:05pm UTC](https://discuss.elastic.co/t/aggregate-performing-unpredictably/251336 "2020-10-07T20:05:21Z")
I am using the aggregate filter plugin to copy a field to all entries from the same file path that have a "nil" entry for that field. It works perfectly for around 95 percent of the time. The strange thing is that with e… --- ## [Shard allocation not working](https://discuss.elastic.co/t/shard-allocation-not-working/250720)
**Author:** [@jdambly](https://discuss.elastic.co/u/jdambly)\ **Replies:** 2\ **Last updated:** [October 7, 2020, 7:05pm UTC](https://discuss.elastic.co/t/shard-allocation-not-working/250720 "2020-10-07T19:05:20Z")
ECK Version: 1.2.1 ElasticSearch Version: 7.9.2 I'm trying to tier my storage in my ES clusters, I have 12 data nodes, 6 are label hot (node.attr.data: hot) and 6 are labeled warm (node.attr.data: warm) I set the shar… --- ## [All data nodes are visible in the elasticHQ](https://discuss.elastic.co/t/all-data-nodes-are-visible-in-the-elastichq/250830)
**Author:** [@keraghu](https://discuss.elastic.co/u/keraghu)\ **Replies:** 1\ **Last updated:** [October 7, 2020, 6:51pm UTC](https://discuss.elastic.co/t/all-data-nodes-are-visible-in-the-elastichq/250830 "2020-10-07T18:51:43Z")
As in the portainer i can see that there 3 data nodes and 1 master nodes are running, but when i see in the elasticHQ, it is showing only 1 master and 1 data node.. Can you please help me how to make it visible all the… --- ## [Stateful or cached search](https://discuss.elastic.co/t/stateful-or-cached-search/250872)
**Author:** [@vadben](https://discuss.elastic.co/u/vadben)\ **Replies:** 4\ **Last updated:** [October 7, 2020, 6:35pm UTC](https://discuss.elastic.co/t/stateful-or-cached-search/250872 "2020-10-07T18:35:44Z")
hi all, I wondering if there is some possibility to store (cache) a result set under some name or ID and use it in further queries, combining with new constraints? We use only the filter context and the index is relative… --- ## [Does increase refresh\_rate effect indexing time?](https://discuss.elastic.co/t/does-increase-refresh-rate-effect-indexing-time/251058)
**Author:** [@linkerc](https://discuss.elastic.co/u/linkerc)\ **Replies:** 7\ **Last updated:** [October 7, 2020, 2:44pm UTC](https://discuss.elastic.co/t/does-increase-refresh-rate-effect-indexing-time/251058 "2020-10-07T14:44:15Z")
Like the title states. I am seeing indexing time on certain writes jump to close 30 seconds. I have configure all my index's refresh rate to 30 seconds. Is this normal? I have also bump machine by doubling the CPU fr… --- ## [Query for matching and not matching at same level](https://discuss.elastic.co/t/query-for-matching-and-not-matching-at-same-level/251331)
**Author:** [@Gopal\_Chauhan](https://discuss.elastic.co/u/Gopal_Chauhan)\ **Replies:** 1\ **Last updated:** [October 7, 2020, 6:15pm UTC](https://discuss.elastic.co/t/query-for-matching-and-not-matching-at-same-level/251331 "2020-10-07T18:15:42Z")
Hi , I have kind of below data in ES (version 6.2). I am trying to write a query with below condition Addresses.Type="Home" and Addresses.Suspended \<\> "B" and Addresses.Suspended \<\> "Y". these three condition should … --- ## [Watcher case unit alert](https://discuss.elastic.co/t/watcher-case-unit-alert/251330)
**Author:** [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\ **Replies:** 0\ **Last updated:** [October 7, 2020, 6:07pm UTC](https://discuss.elastic.co/t/watcher-case-unit-alert/251330 "2020-10-07T18:07:47Z")
Good afternoon I'm trying to configure an alert in a unitary way, I mean, that from a field, I get out or equal to a term that I define; what I need is a term that I ask from the field "monitor.name.keyword" to get from … --- ## [Would Data Too Large CiricuitBreakingException cause a node to go down?](https://discuss.elastic.co/t/would-data-too-large-ciricuitbreakingexception-cause-a-node-to-go-down/251315)
**Author:** [@Jtomage](https://discuss.elastic.co/u/Jtomage)\ **Replies:** 0\ **Last updated:** [October 7, 2020, 4:44pm UTC](https://discuss.elastic.co/t/would-data-too-large-ciricuitbreakingexception-cause-a-node-to-go-down/251315 "2020-10-07T16:44:53Z")
Currently running Elasticsearch 7.0.1 Going through some logging data after being reported that a node has failed / the search application is not working. I m currently seeing a lot of CircuitBreakingException, Data too… --- ## [ES 7.9.2 showing wrong results for \_cat/allocation API](https://discuss.elastic.co/t/es-7-9-2-showing-wrong-results-for-cat-allocation-api/251324)
**Author:** [@prabhakar\_talari](https://discuss.elastic.co/u/prabhakar_talari)\ **Replies:** 0\ **Last updated:** [October 7, 2020, 5:28pm UTC](https://discuss.elastic.co/t/es-7-9-2-showing-wrong-results-for-cat-allocation-api/251324 "2020-10-07T17:28:00Z")
Hi Team, We have recently installed ES 7.9.2, When i look at the \_cat/allocation API it is showing wrong results for disk.used column. Below are the details shards disk.indices disk.used disk.avail disk.total 6 … --- ## [TSVB Visualization takes only the default index pattern into account](https://discuss.elastic.co/t/tsvb-visualization-takes-only-the-default-index-pattern-into-account/251292)
**Author:** [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Replies:** 4\ **Last updated:** [October 7, 2020, 5:05pm UTC](https://discuss.elastic.co/t/tsvb-visualization-takes-only-the-default-index-pattern-into-account/251292 "2020-10-07T17:05:30Z")
Hi All, I am new to visualizations/ dashboards for Kibana 7.6.2 TSVB Visualization takes only the default index pattern into account. We want to create dashboards containing TSVB visualizations from different index pa… --- ## [Dissect filter plugin to map nested fields](https://discuss.elastic.co/t/dissect-filter-plugin-to-map-nested-fields/251314)
**Author:** [@carlos-bernad](https://discuss.elastic.co/u/carlos-bernad)\ **Replies:** 2\ **Last updated:** [October 7, 2020, 5:01pm UTC](https://discuss.elastic.co/t/dissect-filter-plugin-to-map-nested-fields/251314 "2020-10-07T17:01:11Z")
I am listening to events like this with logstash: {"MYSQL":{"eqp":"ST\_22","eqpId":"TT\_1","label":"MONITOR : BW\_TE\_TRACKING \[20\]","local":"2020-09-23T22:35:29.855+05:00"},"tags":\["MYSQL"\]} My goal is to store it in Mong… --- ## [Error - No handler for type \[wildcard\]](https://discuss.elastic.co/t/error-no-handler-for-type-wildcard/251157)
**Author:** [@ojoaquin](https://discuss.elastic.co/u/ojoaquin)\ **Replies:** 5\ **Last updated:** [October 7, 2020, 4:54pm UTC](https://discuss.elastic.co/t/error-no-handler-for-type-wildcard/251157 "2020-10-07T16:54:56Z")
Hi, I'm trying to experiment with the wildcard field since i'm trying to perform queries over text fields that seem to fit perfectly with the description in this article: https://www.elastic.co/blog/find-strings-within-s… --- ## [Custom css in Kibana 7.6.2](https://discuss.elastic.co/t/custom-css-in-kibana-7-6-2/251213)
**Author:** [@gulshann](https://discuss.elastic.co/u/gulshann)\ **Replies:** 1\ **Last updated:** [October 7, 2020, 4:51pm UTC](https://discuss.elastic.co/t/custom-css-in-kibana-7-6-2/251213 "2020-10-07T16:51:25Z")
Hi, How to change the css style i.e color codes , themes, images and text in Kibana 7.6.2 using elastic EUI. [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1762) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1764)