# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1776 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1777 --- ## [Cluster Server Handling](https://discuss.elastic.co/t/cluster-server-handling/249958)
**Author:** [@Amrita\_Mahule](https://discuss.elastic.co/u/Amrita_Mahule)\ **Replies:** 1\ **Last updated:** [October 1, 2020, 1:45am UTC](https://discuss.elastic.co/t/cluster-server-handling/249958 "2020-10-01T01:45:11Z")
Hi Team, If we have 2 servers which are currently in down state. And we have removed those servers from cluster and added them later. So , data for those servers can be recovered or not?? --- ## [ELK Architecture considerations in AWS before deployment](https://discuss.elastic.co/t/elk-architecture-considerations-in-aws-before-deployment/250143)
**Author:** [@myrsecurity](https://discuss.elastic.co/u/myrsecurity)\ **Replies:** 1\ **Last updated:** [October 1, 2020, 1:44am UTC](https://discuss.elastic.co/t/elk-architecture-considerations-in-aws-before-deployment/250143 "2020-10-01T01:44:02Z")
Hi all, we are planning to deploy ELK in AWS infra to receive feeds from around \<500 linux beats ( Metricbeats feed only for now ). In terms of minimum capacity lowest cost what would you estimate we need to cover such n… --- ## [Enable ILM for different filebeat indices](https://discuss.elastic.co/t/enable-ilm-for-different-filebeat-indices/250350)
**Author:** [@borna\_talebi](https://discuss.elastic.co/u/borna_talebi)\ **Replies:** 1\ **Last updated:** [October 1, 2020, 1:40am UTC](https://discuss.elastic.co/t/enable-ilm-for-different-filebeat-indices/250350 "2020-10-01T01:40:22Z")
Hi, I have two different indices in my filebeat. one for cisco module (cisco-beats-0001) and one for the rest of the logs(default filebeat index). so far: I've disabled ILM in filebeat I've created an index lifecycle… --- ## [Clustered elasticsearch setup (two master nodes)](https://discuss.elastic.co/t/clustered-elasticsearch-setup-two-master-nodes/250383)
**Author:** [@yisaac](https://discuss.elastic.co/u/yisaac)\ **Replies:** 2\ **Last updated:** [October 1, 2020, 1:37am UTC](https://discuss.elastic.co/t/clustered-elasticsearch-setup-two-master-nodes/250383 "2020-10-01T01:37:44Z")
Hi, We are currently setting up an environment with two elasticsearch instances (clustered servers). Since it's clustered, we need to make sure that data (indexes) are synched between the two instances. We do not have… --- ## [Cannot cast from \[Long\] to \[long\]. Painless script in query](https://discuss.elastic.co/t/cannot-cast-from-long-to-long-painless-script-in-query/250537)
**Author:** [@awatkins](https://discuss.elastic.co/u/awatkins)\ **Replies:** 0\ **Last updated:** [September 30, 2020, 4:00pm UTC](https://discuss.elastic.co/t/cannot-cast-from-long-to-long-painless-script-in-query/250537 "2020-09-30T16:00:03Z")
Getting error, "Cannot cast from \[Long\] to \[long\]" and have tried many many things to no avail. The data to query against: "Data": { "Number of Components": 3, "Number of Components Array": \[ { "Component": 1, … --- ## [AWS Cloudwatch](https://discuss.elastic.co/t/aws-cloudwatch/250578)
**Author:** [@nan140114](https://discuss.elastic.co/u/nan140114)\ **Replies:** 9\ **Last updated:** [October 1, 2020, 1:14am UTC](https://discuss.elastic.co/t/aws-cloudwatch/250578 "2020-10-01T01:14:38Z")
SO: Ubuntu 20.04 LTS metricbeat: metricbeat version 7.9.2 (amd64), libbeat 7.9.2 \[2ab907f built 2020-09-22 23:25:17 +0000 UTC\] Hello there. I hope you're doing well. I'm trying to set up a metricbeat agent. It will be… --- ## [Create Heatmap of Process Status, ie up down](https://discuss.elastic.co/t/create-heatmap-of-process-status-ie-up-down/250431)
**Author:** [@OgrePSU](https://discuss.elastic.co/u/OgrePSU)\ **Replies:** 1\ **Last updated:** [October 1, 2020, 12:06am UTC](https://discuss.elastic.co/t/create-heatmap-of-process-status-ie-up-down/250431 "2020-10-01T00:06:13Z")
I am trying to create a heatmap of process status, green if up, red if down like this: So I know it can be done, I just don't know how. Thanks in advance --- ## [Context Suggester across multiple indices with same schema](https://discuss.elastic.co/t/context-suggester-across-multiple-indices-with-same-schema/250559)
**Author:** [@Bhavik92](https://discuss.elastic.co/u/Bhavik92)\ **Replies:** 3\ **Last updated:** [September 30, 2020, 11:38pm UTC](https://discuss.elastic.co/t/context-suggester-across-multiple-indices-with-same-schema/250559 "2020-09-30T23:38:37Z")
We're evaluating ElasticSearch for our use-case where customer can search over a data repository with multiple topics. Sometimes the user will select a topic to filter the results and sometimes he might want to query all… --- ## [Filebeat not picking up /var/log/containers/\*.log k8s](https://discuss.elastic.co/t/filebeat-not-picking-up-var-log-containers-log-k8s/250576)
**Author:** [@dsuma](https://discuss.elastic.co/u/dsuma)\ **Replies:** 0\ **Last updated:** [September 30, 2020, 11:25pm UTC](https://discuss.elastic.co/t/filebeat-not-picking-up-var-log-containers-log-k8s/250576 "2020-09-30T23:25:42Z")
I have filebeats deployed onto my kube cluster through the elastic helm chart. The pod is privileged. Filebeats is picking up the new log that I create on the node. touch /var/log/containers/mylog.log and then I add stu… --- ## [Discover \>\> Count hits is no longer displayed with expected number format](https://discuss.elastic.co/t/discover-count-hits-is-no-longer-displayed-with-expected-number-format/250421)
**Author:** [@kercio](https://discuss.elastic.co/u/kercio)\ **Replies:** 3\ **Last updated:** [September 30, 2020, 11:14pm UTC](https://discuss.elastic.co/t/discover-count-hits-is-no-longer-displayed-with-expected-number-format/250421 "2020-09-30T23:14:03Z")
After upgrading from Kibana 6.8 to 7.9 the Count hits in Discover is no longer displayed with expected number format. Is it configurable? --- ## [Logging indices for separate websites](https://discuss.elastic.co/t/logging-indices-for-separate-websites/250361)
**Author:** [@bram](https://discuss.elastic.co/u/bram)\ **Replies:** 2\ **Last updated:** [September 30, 2020, 10:10pm UTC](https://discuss.elastic.co/t/logging-indices-for-separate-websites/250361 "2020-09-30T22:10:14Z")
Hey, We're running multiple webshops on the same application. And we're logging some API calls we're making (with separate index for each logging use-case). We have one shared logging elasticsearch cluster. But for the… --- ## [Is it reasonable to use multiple instances of Filebeat (Windows) on a production system?](https://discuss.elastic.co/t/is-it-reasonable-to-use-multiple-instances-of-filebeat-windows-on-a-production-system/250457)
**Author:** [@ruben.crespo.cano](https://discuss.elastic.co/u/ruben.crespo.cano)\ **Replies:** 4\ **Last updated:** [September 30, 2020, 10:02pm UTC](https://discuss.elastic.co/t/is-it-reasonable-to-use-multiple-instances-of-filebeat-windows-on-a-production-system/250457 "2020-09-30T22:02:51Z")
To whom it may concern, Background: Currently in our windows servers we have different applications that belong to different clients. Therefore, we want to create different indexes with different ILM policies since each… --- ## [No logs in Kibana](https://discuss.elastic.co/t/no-logs-in-kibana/250555)
**Author:** [@SaraBetty](https://discuss.elastic.co/u/SaraBetty)\ **Replies:** 5\ **Last updated:** [September 30, 2020, 9:37pm UTC](https://discuss.elastic.co/t/no-logs-in-kibana/250555 "2020-09-30T21:37:29Z")
Hello everyone, I performed the beats installation (packetbeat/winlogbeat) on the DCs and the logstash installation on the server. I am not getting the logs in Kibana, though i see the packets (connectivity) between the… --- ## [Can Kibana do DNS lookups on IP addresses ingested for enriching the data, without using Logstash](https://discuss.elastic.co/t/can-kibana-do-dns-lookups-on-ip-addresses-ingested-for-enriching-the-data-without-using-logstash/250544)
**Author:** [@Suro](https://discuss.elastic.co/u/Suro)\ **Replies:** 1\ **Last updated:** [September 30, 2020, 9:01pm UTC](https://discuss.elastic.co/t/can-kibana-do-dns-lookups-on-ip-addresses-ingested-for-enriching-the-data-without-using-logstash/250544 "2020-09-30T21:01:03Z")
The DC logs ingested needs to be enriched further to get the host names. How is it possible to do without a Logstash in place. --- ## [How to deal with inconsistent dates (day or month or year may be missing)?](https://discuss.elastic.co/t/how-to-deal-with-inconsistent-dates-day-or-month-or-year-may-be-missing/250436)
**Author:** [@wblondel](https://discuss.elastic.co/u/wblondel)\ **Replies:** 4\ **Last updated:** [September 30, 2020, 8:37pm UTC](https://discuss.elastic.co/t/how-to-deal-with-inconsistent-dates-day-or-month-or-year-may-be-missing/250436 "2020-09-30T20:37:57Z")
Hi, First of all, I'm a beginner with the ELK stack, so please don't hurt me if I did stupid things :laughing: I am importing CSV files that have the following structure: "nomprenom";"sexe";"datenaiss";"lieunaiss";"co… --- ## [Timelion not equal](https://discuss.elastic.co/t/timelion-not-equal/249171)
**Author:** [@prophoto](https://discuss.elastic.co/u/prophoto)\ **Replies:** 3\ **Last updated:** [September 30, 2020, 8:36pm UTC](https://discuss.elastic.co/t/timelion-not-equal/249171 "2020-09-30T20:36:07Z")
Here is my current Timelion query. How do I EXCLUDE lines? I'd like to exclude apache log lines that have source.ip ::1 and destination.domain localhost. Thanks. .es(q='event.dataset:apache.access AND agent.name:server7… --- ## [Stuck at loading page](https://discuss.elastic.co/t/stuck-at-loading-page/250393)
**Author:** [@obones](https://discuss.elastic.co/u/obones)\ **Replies:** 4\ **Last updated:** [September 30, 2020, 8:25pm UTC](https://discuss.elastic.co/t/stuck-at-loading-page/250393 "2020-09-30T20:25:29Z")
Hello, I have a running instance of ElasticSearch and Kibana and while they both appear to be started, the Kibana page never goes past the "Loading Elastic Kibana" text with the logo on top and the moving bar beneath. … --- ## [Heatmap percentage mode local for each x-value](https://discuss.elastic.co/t/heatmap-percentage-mode-local-for-each-x-value/249705)
**Author:** [@NiclasK](https://discuss.elastic.co/u/NiclasK)\ **Replies:** 1\ **Last updated:** [September 30, 2020, 8:23pm UTC](https://discuss.elastic.co/t/heatmap-percentage-mode-local-for-each-x-value/249705 "2020-09-30T20:23:39Z")
Hi, I'm trying to use a heatmap to show error count vs software version. On the Y-axis I have all the errors that can be reported by our software. On the X-axis I have the version. I would like the percentage to be calc… --- ## [Can not open Stack monitoring](https://discuss.elastic.co/t/can-not-open-stack-monitoring/237772)
**Author:** [@v.n](https://discuss.elastic.co/u/v.n)\ **Replies:** 45\ **Last updated:** [September 30, 2020, 8:16pm UTC](https://discuss.elastic.co/t/can-not-open-stack-monitoring/237772 "2020-09-30T20:16:15Z")
Hi, Recently I couldn't open Stack Monitoring. Then I decided to upgrade to new version 7.8.0. But after upgrading my problem still exists. My user has role superuser so I don't understand why I cannot have access to m… --- ## [How to create Pin different filters queries on different dashboard](https://discuss.elastic.co/t/how-to-create-pin-different-filters-queries-on-different-dashboard/250355)
**Author:** [@pankaj0172](https://discuss.elastic.co/u/pankaj0172)\ **Replies:** 1\ **Last updated:** [September 30, 2020, 8:15pm UTC](https://discuss.elastic.co/t/how-to-create-pin-different-filters-queries-on-different-dashboard/250355 "2020-09-30T20:15:16Z")
Hi, Can someone please help me with pinning different queries filter on respective dashboard in Kibana as I have multiple dashboard but when I enabled, it showing on all dashboard. I want to use specific filter on speci… --- ## [Problem with regex scripted field kibana using painless lang!](https://discuss.elastic.co/t/problem-with-regex-scripted-field-kibana-using-painless-lang/249291)
**Author:** [@le\_ba\_nam](https://discuss.elastic.co/u/le_ba_nam)\ **Replies:** 0\ **Last updated:** [September 21, 2020, 3:19am UTC](https://discuss.elastic.co/t/problem-with-regex-scripted-field-kibana-using-painless-lang/249291 "2020-09-21T03:19:30Z")
I want to create my own regex to get substring from some logs. This is my script: if (doc\['message.keyword'\].length == 0) { return "unavailable"; } else { def m = /.\*?http(.\*?)wsdl.\*?\\n/.matcher(doc\['message.keywor… --- ## [Difference of two counts on a "metric" visualization object](https://discuss.elastic.co/t/difference-of-two-counts-on-a-metric-visualization-object/249981)
**Author:** [@rpdieego](https://discuss.elastic.co/u/rpdieego)\ **Replies:** 1\ **Last updated:** [September 30, 2020, 6:54pm UTC](https://discuss.elastic.co/t/difference-of-two-counts-on-a-metric-visualization-object/249981 "2020-09-30T18:54:15Z")
Hello Everyone, I'm working on a project where our goal is to monitor a series of systems, and it's important to us to understand if the number of messages were the same on the outputs of each of these systems. In orde… --- ## [Logstash and filebeat not working](https://discuss.elastic.co/t/logstash-and-filebeat-not-working/250503)
**Author:** [@Lusca\_lusca](https://discuss.elastic.co/u/Lusca_lusca)\ **Replies:** 1\ **Last updated:** [September 30, 2020, 6:42pm UTC](https://discuss.elastic.co/t/logstash-and-filebeat-not-working/250503 "2020-09-30T18:42:48Z")
Hi everyone Does anyone know if there is a command that will show me all logs that filebeat and logstash are seeing? I am trying to filter some logs to display it on kibana but the logs that I need to filter will not… --- ## [Duplicaties with Logstash rss plugin](https://discuss.elastic.co/t/duplicaties-with-logstash-rss-plugin/250521)
**Author:** [@Robin020](https://discuss.elastic.co/u/Robin020)\ **Replies:** 2\ **Last updated:** [September 30, 2020, 6:33pm UTC](https://discuss.elastic.co/t/duplicaties-with-logstash-rss-plugin/250521 "2020-09-30T18:33:41Z")
Hello, Currently I am configuring a rss feed with logstash rss plugin. This is my logstash pipeline config: input { rss { url =\> "" interval =\> 7200 tags =\> \["rs… --- ## [SSL with Filebeat not working](https://discuss.elastic.co/t/ssl-with-filebeat-not-working/250520)
**Author:** [@santos1204](https://discuss.elastic.co/u/santos1204)\ **Replies:** 3\ **Last updated:** [September 30, 2020, 5:00pm UTC](https://discuss.elastic.co/t/ssl-with-filebeat-not-working/250520 "2020-09-30T17:00:54Z")
Hi, I'm trying to secure the traffic between filebeats hosts and the logstash server, my logstash config is; input { beats { port =\> 5044 ssl =\> true ssl\_certificate\_authorities =\> \["/etc/filebeat/removed.pem"\] s… --- ## [Getting Started with 7.9.2 on Debian 10](https://discuss.elastic.co/t/getting-started-with-7-9-2-on-debian-10/250411)
**Author:** [@epretorious](https://discuss.elastic.co/u/epretorious)\ **Replies:** 7\ **Last updated:** [September 30, 2020, 4:56pm UTC](https://discuss.elastic.co/t/getting-started-with-7-9-2-on-debian-10/250411 "2020-09-30T16:56:06Z")
Hello, All! I've installed Elasticsearch using the .tar.gz method onto my Debian 10 host. But when I attempt to verify that Elasticsearch is listening and responding to inquiries by sending an HTTP request to port 9200 … --- ## [Defining Source When Using Filebeat](https://discuss.elastic.co/t/defining-source-when-using-filebeat/249877)
**Author:** [@teej](https://discuss.elastic.co/u/teej)\ **Replies:** 2\ **Last updated:** [September 30, 2020, 4:32pm UTC](https://discuss.elastic.co/t/defining-source-when-using-filebeat/249877 "2020-09-30T16:32:08Z")
Hi, I am using filebeat to read xml files from a directory and then feed it to logstash where it is filetered then sent out to elastic. I thought that perhaps when the pipeline gets created in the logstash config, it do… --- ## [Logstash not able to fetch messages from Amazon MSK](https://discuss.elastic.co/t/logstash-not-able-to-fetch-messages-from-amazon-msk/250538)
**Author:** [@Akhil96](https://discuss.elastic.co/u/Akhil96)\ **Replies:** 0\ **Last updated:** [September 30, 2020, 4:20pm UTC](https://discuss.elastic.co/t/logstash-not-able-to-fetch-messages-from-amazon-msk/250538 "2020-09-30T16:20:36Z")
I am trying to consume from an MSK cluster using logstash and push the messages to an Elasticsearch instance. Due to some reason the data is not getting fetched correctly, and getting below message in logs. Skipping fet… --- ## [How to draw a cummulative min chart (not cummulative sum) in kibana](https://discuss.elastic.co/t/how-to-draw-a-cummulative-min-chart-not-cummulative-sum-in-kibana/250226)
**Author:** [@Jayasri\_Cimba](https://discuss.elastic.co/u/Jayasri_Cimba)\ **Replies:** 2\ **Last updated:** [September 30, 2020, 3:57pm UTC](https://discuss.elastic.co/t/how-to-draw-a-cummulative-min-chart-not-cummulative-sum-in-kibana/250226 "2020-09-30T15:57:36Z")
I am trying to do cummulative min chart in kibana , is there a possibility to do that --- ## [Storage Size exceeding ILM rollover max\_size](https://discuss.elastic.co/t/storage-size-exceeding-ilm-rollover-max-size/250428)
**Author:** [@markroland](https://discuss.elastic.co/u/markroland)\ **Replies:** 2\ **Last updated:** [September 30, 2020, 3:57pm UTC](https://discuss.elastic.co/t/storage-size-exceeding-ilm-rollover-max-size/250428 "2020-09-30T15:57:12Z")
I have read through the ILM documentation and it's my understanding that if I have a rollover policy with a max\_age and a max\_size set, that the index should rollover when one of these conditions is met, but that's not w… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1775) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1777)