# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1775 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1776 --- ## [Error after switching to ECS: 1 of 2 shards failed The data you are seeing might be incomplete or wrong](https://discuss.elastic.co/t/error-after-switching-to-ecs-1-of-2-shards-failed-the-data-you-are-seeing-might-be-incomplete-or-wrong/250540)
**Author:** [@michielvoo](https://discuss.elastic.co/u/michielvoo)\ **Replies:** 1\ **Last updated:** [October 1, 2020, 1:20pm UTC](https://discuss.elastic.co/t/error-after-switching-to-ecs-1-of-2-shards-failed-the-data-you-are-seeing-might-be-incomplete-or-wrong/250540 "2020-10-01T13:20:01Z")
I recently changed the logging configuration in my .NET application to use the official Serilog ECS formatter from Elastic (based on the recommendation in this official documentation). Now when I go to the discover app … --- ## [Bootstrap checks failed](https://discuss.elastic.co/t/bootstrap-checks-failed/250679)
**Author:** [@muthug](https://discuss.elastic.co/u/muthug)\ **Replies:** 4\ **Last updated:** [October 1, 2020, 1:11pm UTC](https://discuss.elastic.co/t/bootstrap-checks-failed/250679 "2020-10-01T13:11:48Z")
\[2020-10-01T14:44:51,442\]\[INFO \]\[o.e.e.NodeEnvironment \] \[graylogES-1\] using \[1\] data paths, mounts \[\[/opt (/dev/mapper/vg00-lvopt)\]\], net usable\_space \[12.8gb\], net total\_space \[25.4gb\], types \[ext4\] \[2020-10-01T14:… --- ## [Querying parent-child documents](https://discuss.elastic.co/t/querying-parent-child-documents/250631)
**Author:** [@Priyam\_Maheshwari](https://discuss.elastic.co/u/Priyam_Maheshwari)\ **Replies:** 1\ **Last updated:** [October 1, 2020, 1:08pm UTC](https://discuss.elastic.co/t/querying-parent-child-documents/250631 "2020-10-01T13:08:46Z")
I have a following index which stores the course details (I have truncated some attributes for brevity): { "settings": { "index": { "number\_of\_replicas": "1", "number\_of\_shards": "1" } }, "alia… --- ## [Increasing The Frequency of Receiving UDP Data of Filebeat](https://discuss.elastic.co/t/increasing-the-frequency-of-receiving-udp-data-of-filebeat/250683)
**Author:** [@gizem](https://discuss.elastic.co/u/gizem)\ **Replies:** 0\ **Last updated:** [October 1, 2020, 1:07pm UTC](https://discuss.elastic.co/t/increasing-the-frequency-of-receiving-udp-data-of-filebeat/250683 "2020-10-01T13:07:30Z")
Hi, I listen a udp port with filebeat, and the data comes from the port is sended to elasticsearch directly. Then I check it from kibana. The problem is the duration is very long between the data incoming and sending t… --- ## [Harvester could not be started on new file: /usr/share/apps/logs/sample.log](https://discuss.elastic.co/t/harvester-could-not-be-started-on-new-file-usr-share-apps-logs-sample-log/250648)
**Author:** [@jaraws](https://discuss.elastic.co/u/jaraws)\ **Replies:** 0\ **Last updated:** [October 1, 2020, 10:32am UTC](https://discuss.elastic.co/t/harvester-could-not-be-started-on-new-file-usr-share-apps-logs-sample-log/250648 "2020-10-01T10:32:21Z")
I am getting following error while starting Filebeat container. 2020-10-01 ERROR log/input.go:519 Harvester could not be started on new file: /usr/share/apps/logs/sample.log, Err: registry already stopped … --- ## [Roll up index does not populate Time field](https://discuss.elastic.co/t/roll-up-index-does-not-populate-time-field/249681)
**Author:** [@zaratustra689](https://discuss.elastic.co/u/zaratustra689)\ **Replies:** 3\ **Last updated:** [October 1, 2020, 12:57pm UTC](https://discuss.elastic.co/t/roll-up-index-does-not-populate-time-field/249681 "2020-10-01T12:57:12Z")
Hi! I'm new to Roll Up index feature and I'm trying to configure some basic index so that I can start doing queries and visualizations. I'm using ElasticSearch Stack in version 6.6.2 with the sample web logs that comes… --- ## [Change 'total\_auto\_throttle\_in\_bytes' in Elasticsearch](https://discuss.elastic.co/t/change-total-auto-throttle-in-bytes-in-elasticsearch/249463)
**Author:** [@Bahar\_Yilmaz](https://discuss.elastic.co/u/Bahar_Yilmaz)\ **Replies:** 3\ **Last updated:** [October 1, 2020, 12:35pm UTC](https://discuss.elastic.co/t/change-total-auto-throttle-in-bytes-in-elasticsearch/249463 "2020-10-01T12:35:21Z")
Is there any way to change ' total\_auto\_throttle\_in\_bytes' value in Elasticsearch. Is this value changable ? Thanks in advance. --- ## [Multiline stack traces (.net) with whitespace](https://discuss.elastic.co/t/multiline-stack-traces-net-with-whitespace/249954)
**Author:** [@Raman\_Sawhney](https://discuss.elastic.co/u/Raman_Sawhney)\ **Replies:** 3\ **Last updated:** [October 1, 2020, 12:23pm UTC](https://discuss.elastic.co/t/multiline-stack-traces-net-with-whitespace/249954 "2020-10-01T12:23:58Z")
I have issues with Multiline stack traces (.net) with whitespace. logs are getting split and we are not able to troubleshoot the things its more time consuming. I tried the fix from ES-stack website but after apply… --- ## [Complex query with priorities](https://discuss.elastic.co/t/complex-query-with-priorities/250667)
**Author:** [@Patrik\_Vaclavek](https://discuss.elastic.co/u/Patrik_Vaclavek)\ **Replies:** 0\ **Last updated:** [October 1, 2020, 12:00pm UTC](https://discuss.elastic.co/t/complex-query-with-priorities/250667 "2020-10-01T12:00:24Z")
Hello, I am struggling to figure this out. I've got products with many prices based on available discounts and price lists with assigned priorities. The 'price' part mapping looks like this: "price": { "properties"… --- ## [Export kibana viisualization using api](https://discuss.elastic.co/t/export-kibana-viisualization-using-api/250009)
**Author:** [@liorg2](https://discuss.elastic.co/u/liorg2)\ **Replies:** 5\ **Last updated:** [October 1, 2020, 11:47am UTC](https://discuss.elastic.co/t/export-kibana-viisualization-using-api/250009 "2020-10-01T11:47:37Z")
Hello Is there any way to make an api/ curl request to Kibana, and get a graph image (any type of visualization)? --- ## [Configure logstash to show logs from port 5002](https://discuss.elastic.co/t/configure-logstash-to-show-logs-from-port-5002/250205)
**Author:** [@Lusca\_lusca](https://discuss.elastic.co/u/Lusca_lusca)\ **Replies:** 19\ **Last updated:** [October 1, 2020, 11:44am UTC](https://discuss.elastic.co/t/configure-logstash-to-show-logs-from-port-5002/250205 "2020-10-01T11:44:56Z")
I am knew to ELK and I can't see the logs coming from port 5002 on kibana. Can anyone please help me configure logstash to send the logs to kibana? --- ## [Encrypting traffic between browser and kibana](https://discuss.elastic.co/t/encrypting-traffic-between-browser-and-kibana/250569)
**Author:** [@Joe\_Monaco](https://discuss.elastic.co/u/Joe_Monaco)\ **Replies:** 4\ **Last updated:** [October 1, 2020, 11:34am UTC](https://discuss.elastic.co/t/encrypting-traffic-between-browser-and-kibana/250569 "2020-10-01T11:34:19Z")
https://www.elastic.co/guide/en/kibana/current/configuring-tls.html provides steps to enable encryption between browser and kibana. Following these instructions on a 7.9.2 instance and using a server certificate/private… --- ## [Double documents?](https://discuss.elastic.co/t/double-documents/248991)
**Author:** [@Tuckson](https://discuss.elastic.co/u/Tuckson)\ **Replies:** 13\ **Last updated:** [October 1, 2020, 10:56am UTC](https://discuss.elastic.co/t/double-documents/248991 "2020-10-01T10:56:48Z")
Hi, For some reason, all documents end up twice in my indexes. and I do not have the slightest idea why... I mean... Even the doc\_id seems the same. Consider these 2: Both exactly the same. When I log this on the a… --- ## [Failed to parse field \[datasize\] of type \[integer\] in document with id](https://discuss.elastic.co/t/failed-to-parse-field-datasize-of-type-integer-in-document-with-id/250650)
**Author:** [@martb](https://discuss.elastic.co/u/martb)\ **Replies:** 0\ **Last updated:** [October 1, 2020, 10:56am UTC](https://discuss.elastic.co/t/failed-to-parse-field-datasize-of-type-integer-in-document-with-id/250650 "2020-10-01T10:56:16Z")
Hi, I'm getting the following error from logstash. The field is mapped as an integer and the number is only 11 digits long. Is this mapped as the correct type? Please advise. \[2020-10-01T10:10:18,893\]\[WARN \]\[logstash.o… --- ## [System Requirements](https://discuss.elastic.co/t/system-requirements/250649)
**Author:** [@PatNae](https://discuss.elastic.co/u/PatNae)\ **Replies:** 0\ **Last updated:** [October 1, 2020, 10:42am UTC](https://discuss.elastic.co/t/system-requirements/250649 "2020-10-01T10:42:33Z")
Hi all I am working on a project where data is delivered to elasticsearch using winlogbeat - logstash - kiibana. There are 4 source servers, each 1 file with 1 GB, so 4 \* 1 GB, these data should be stored 180 Tg, so 411… --- ## [Manage Logstash using API](https://discuss.elastic.co/t/manage-logstash-using-api/250638)
**Author:** [@pchakour](https://discuss.elastic.co/u/pchakour)\ **Replies:** 0\ **Last updated:** [October 1, 2020, 9:59am UTC](https://discuss.elastic.co/t/manage-logstash-using-api/250638 "2020-10-01T09:59:25Z")
Hello ! I have a little question about Logstash management. I want to know if an API exists on Logstash to create, delete or edit a pipeline ? The ony API that I found in the documentation is dedicated to the Logstash… --- ## [Elasticsearch stopped due to (code = kill, signal = kill)](https://discuss.elastic.co/t/elasticsearch-stopped-due-to-code-kill-signal-kill/250622)
**Author:** [@sai92](https://discuss.elastic.co/u/sai92)\ **Replies:** 1\ **Last updated:** [October 1, 2020, 8:48am UTC](https://discuss.elastic.co/t/elasticsearch-stopped-due-to-code-kill-signal-kill/250622 "2020-10-01T08:48:49Z")
Hi, I use elasticsearch to store data from different IoT sensors and it was working good but elasticsearch stopped and when i check the log it show me like this can you please say which thing caused this error. elastic… --- ## [Logstash if \>= causes logstash to crash](https://discuss.elastic.co/t/logstash-if-causes-logstash-to-crash/250547)
**Author:** [@probson](https://discuss.elastic.co/u/probson)\ **Replies:** 3\ **Last updated:** [September 30, 2020, 7:07pm UTC](https://discuss.elastic.co/t/logstash-if-causes-logstash-to-crash/250547 "2020-09-30T19:07:16Z")
Hi, I am on ES 7.9.2, i am writing a logstash parser to add a severity based on the risk level. The risk\_score is between 0-10 and can be to 1 decimal place mutate { convert =\> { "risk\_score" =\> "float" } } if… --- ## [Why include\_lines is not working?](https://discuss.elastic.co/t/why-include-lines-is-not-working/250606)
**Author:** [@jaraws](https://discuss.elastic.co/u/jaraws)\ **Replies:** 0\ **Last updated:** [October 1, 2020, 6:58am UTC](https://discuss.elastic.co/t/why-include-lines-is-not-working/250606 "2020-10-01T06:58:11Z")
I have the following file yaml configuration to pick certain lines with string expressions, but filebeat doesnt seems to be prpagating messages to elastic search: filebeat.inputs: - type: log enabled: true paths:… --- ## [Esrally command line parameters](https://discuss.elastic.co/t/esrally-command-line-parameters/250507)
**Author:** [@Oleg\_Ruchovets](https://discuss.elastic.co/u/Oleg_Ruchovets)\ **Replies:** 1\ **Last updated:** [October 1, 2020, 7:04am UTC](https://discuss.elastic.co/t/esrally-command-line-parameters/250507 "2020-10-01T07:04:58Z")
Hello, I am running a set of rally tests and I would like to preserve data/index and run next time with existing data in elastic. I tried to use --preserve-install=true option but it is not accepted. esrally: error: a… --- ## [Elastic Search Warm node taking too much of Ram than the Heap assigned to that](https://discuss.elastic.co/t/elastic-search-warm-node-taking-too-much-of-ram-than-the-heap-assigned-to-that/250605)
**Author:** [@Ozil](https://discuss.elastic.co/u/Ozil)\ **Replies:** 0\ **Last updated:** [October 1, 2020, 6:53am UTC](https://discuss.elastic.co/t/elastic-search-warm-node-taking-too-much-of-ram-than-the-heap-assigned-to-that/250605 "2020-10-01T06:53:45Z")
Hi All I am using two data nodes to achieve hot and warm architecture. Both are assigned with 8 GB RAM as Heap Size. The total available is 64 GB RAM. I am using the rollover and allocation settings to achieve my hot wa… --- ## [Taking more time to send data to elastic search](https://discuss.elastic.co/t/taking-more-time-to-send-data-to-elastic-search/250602)
**Author:** [@PRASHANTHMATOORI](https://discuss.elastic.co/u/PRASHANTHMATOORI)\ **Replies:** 0\ **Last updated:** [October 1, 2020, 6:41am UTC](https://discuss.elastic.co/t/taking-more-time-to-send-data-to-elastic-search/250602 "2020-10-01T06:41:58Z")
Hi all, Logstash taking more time to send data When I am sending data to elastic search via logstash script. I have 6lakhs records in csv file with 3 fields such as name, date &time, count. Would appreciate if any one h… --- ## [Index.lifecycle.rollover\_alias \[filebeat-7.8.0\] does not point to index](https://discuss.elastic.co/t/index-lifecycle-rollover-alias-filebeat-7-8-0-does-not-point-to-index/245642)
**Author:** [@thomas7467](https://discuss.elastic.co/u/thomas7467)\ **Replies:** 4\ **Last updated:** [October 1, 2020, 6:23am UTC](https://discuss.elastic.co/t/index-lifecycle-rollover-alias-filebeat-7-8-0-does-not-point-to-index/245642 "2020-10-01T06:23:56Z")
Hi All, I've the following errors il eleastic log files for the indexes Lifecycle Management for the indexes and don't know how to solve them... Could someone give me some clues? Thanks, \*java.lang.IllegalArgumentEx… --- ## [Display a current hour metric on a Today time range dashboard](https://discuss.elastic.co/t/display-a-current-hour-metric-on-a-today-time-range-dashboard/249919)
**Author:** [@edwardj3](https://discuss.elastic.co/u/edwardj3)\ **Replies:** 2\ **Last updated:** [October 1, 2020, 5:51am UTC](https://discuss.elastic.co/t/display-a-current-hour-metric-on-a-today-time-range-dashboard/249919 "2020-10-01T05:51:57Z")
Hello all, I have a dashboard with multiple panes that are using the Today date range. Is it possible to show a metric of average response time for the current hour of today e.g. if current time was 08:15, it would sho… --- ## [Kibana Canvas not providing correct tome format](https://discuss.elastic.co/t/kibana-canvas-not-providing-correct-tome-format/250202)
**Author:** [@Gauti](https://discuss.elastic.co/u/Gauti)\ **Replies:** 2\ **Last updated:** [October 1, 2020, 5:18am UTC](https://discuss.elastic.co/t/kibana-canvas-not-providing-correct-tome-format/250202 "2020-10-01T05:18:49Z")
Hi All, We are creating a table in canvas, everything is ok expect i choose any time field, it always shows me the time as -5hrs in the display. I am not using browser time, instead have choose CST time zone, Display … --- ## [Filebeat is not sending logs to Logstash, logstash is localhost](https://discuss.elastic.co/t/filebeat-is-not-sending-logs-to-logstash-logstash-is-localhost/250588)
**Author:** [@Sravan\_Kumar\_Guduru](https://discuss.elastic.co/u/Sravan_Kumar_Guduru)\ **Replies:** 1\ **Last updated:** [October 1, 2020, 3:54am UTC](https://discuss.elastic.co/t/filebeat-is-not-sending-logs-to-logstash-logstash-is-localhost/250588 "2020-10-01T03:54:04Z")
Hi All, I am having trouble with my filebeat/logstash. connectivity seems to be inconsistenst. When i try it in debug mode it works fine but when i use it with systemctl start it fails . Below are my filebeat and logsta… --- ## [Convert Elasticsearch output to CSV file using "jq"](https://discuss.elastic.co/t/convert-elasticsearch-output-to-csv-file-using-jq/250587)
**Author:** [@tusharnemade](https://discuss.elastic.co/u/tusharnemade)\ **Replies:** 1\ **Last updated:** [October 1, 2020, 3:49am UTC](https://discuss.elastic.co/t/convert-elasticsearch-output-to-csv-file-using-jq/250587 "2020-10-01T03:49:01Z")
Hi Team Could you please help me with syntax of jq to be used for getting , entire "\_source" contents of elasticsearch index into single row of csv file. I am trying out multiple ways but its not working ... Thanks T… --- ## [Ldap session expired very quick](https://discuss.elastic.co/t/ldap-session-expired-very-quick/250276)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 2\ **Last updated:** [October 1, 2020, 3:00am UTC](https://discuss.elastic.co/t/ldap-session-expired-very-quick/250276 "2020-10-01T03:00:23Z")
Hi all, I have been trying the ldap authentication feature on elastic, and have successfully config for it to work on elastic, now everytime i tried to authenticate with ldap on kibana it took like 5 to 10 min for me to… --- ## [How to Put Elasticsearch data to Oracle Table](https://discuss.elastic.co/t/how-to-put-elasticsearch-data-to-oracle-table/250498)
**Author:** [@tusharnemade](https://discuss.elastic.co/u/tusharnemade)\ **Replies:** 7\ **Last updated:** [October 1, 2020, 2:48am UTC](https://discuss.elastic.co/t/how-to-put-elasticsearch-data-to-oracle-table/250498 "2020-10-01T02:48:26Z")
Hi Could you please help me with my requirement of putting Elasticsearch index data into oracle table. Do we have any additional plugin required for logstash to achieve same. ? I am aware of CSV method , but its too t… --- ## [Kibana monitoring shows empty nodes](https://discuss.elastic.co/t/kibana-monitoring-shows-empty-nodes/249829)
**Author:** [@fanqiaoqing](https://discuss.elastic.co/u/fanqiaoqing)\ **Replies:** 5\ **Last updated:** [October 1, 2020, 2:02am UTC](https://discuss.elastic.co/t/kibana-monitoring-shows-empty-nodes/249829 "2020-10-01T02:02:45Z")
Hi Elastic, We are using the kibana 7.2.1, we have around 200 nodes in our clusters. Recently, we found the kibana monitoring shows empty nodes I uploaded a screenshot, you can check that. Meanwhile we had try many so… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1774) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1776)