# Elastic Stack

**URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1780

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1781

---

## [Error index management Metricbeat to Logstash](https://discuss.elastic.co/t/error-index-management-metricbeat-to-logstash/249756)

<div class="topic-metadata">

**Author:** [@kennedy](https://discuss.elastic.co/u/kennedy)\
**Replies:** 5\
**Last updated:** [September 29, 2020, 8:59am UTC](https://discuss.elastic.co/t/error-index-management-metricbeat-to-logstash/249756 "2020-09-29T08:59:22Z")

</div>

I have configured metricbeat and feeding the logs to lagstash. But when im trying to use command : metricbeat setup the following error is coming: Exiting: Index management requested but the Elasticsearch output is not…

---

## [Custom metrics from bunch of servers](https://discuss.elastic.co/t/custom-metrics-from-bunch-of-servers/250209)

<div class="topic-metadata">

**Author:** [@rmrfchik](https://discuss.elastic.co/u/rmrfchik)\
**Replies:** 2\
**Last updated:** [September 29, 2020, 8:36am UTC](https://discuss.elastic.co/t/custom-metrics-from-bunch-of-servers/250209 "2020-09-29T08:36:09Z")

</div>

I have a number of different servers (php, java...). All of the servers uses different user tracking cookies and are behind nginx. I already have access.log with all cookies I need and all of them are feeded to ES with …

---

## [Logstash integration with Amazon Elasticsearch](https://discuss.elastic.co/t/logstash-integration-with-amazon-elasticsearch/250232)

<div class="topic-metadata">

**Author:** [@Akhil96](https://discuss.elastic.co/u/Akhil96)\
**Replies:** 2\
**Last updated:** [September 29, 2020, 8:13am UTC](https://discuss.elastic.co/t/logstash-integration-with-amazon-elasticsearch/250232 "2020-09-29T08:13:28Z")

</div>

Hi Team, I have setup logstash to fetch from amazon MSK and then push the messages to Amazon Elasticsearch with Kibana integration. The setup works smoothly in QA and Dev environments but when I use the same logstash im…

---

## [How to know the which Elastic node executing the API call with in the Elastic Cluster?](https://discuss.elastic.co/t/how-to-know-the-which-elastic-node-executing-the-api-call-with-in-the-elastic-cluster/250136)

<div class="topic-metadata">

**Author:** [@gsece](https://discuss.elastic.co/u/gsece)\
**Replies:** 4\
**Last updated:** [September 29, 2020, 7:23am UTC](https://discuss.elastic.co/t/how-to-know-the-which-elastic-node-executing-the-api-call-with-in-the-elastic-cluster/250136 "2020-09-29T07:23:08Z")

</div>

We have 3 node elastic cluster and all are master eligible nodes. We use bulk or index api to post the document via API. How to identify which elastic node executing the API with in the cluster..

---

## [Inserting documents are very slow in elastic 6.8.5 server](https://discuss.elastic.co/t/inserting-documents-are-very-slow-in-elastic-6-8-5-server/250255)

<div class="topic-metadata">

**Author:** [@Prabaharan\_Kathiresa](https://discuss.elastic.co/u/Prabaharan_Kathiresa)\
**Replies:** 1\
**Last updated:** [September 29, 2020, 7:22am UTC](https://discuss.elastic.co/t/inserting-documents-are-very-slow-in-elastic-6-8-5-server/250255 "2020-09-29T07:22:23Z")

</div>

Hi Team we are seeing slowness when inserting documents in the elastic server. we are using 6.8.5 elastic server and using 6.8.5 RestHighLevelClient. IndexResponse resp = restHighLevelClient.index(indexRequest, Requ…

---

## [Elasticsearch transform index using scripted fields](https://discuss.elastic.co/t/elasticsearch-transform-index-using-scripted-fields/249385)

<div class="topic-metadata">

**Author:** [@geekganesh](https://discuss.elastic.co/u/geekganesh)\
**Replies:** 2\
**Last updated:** [September 29, 2020, 7:12am UTC](https://discuss.elastic.co/t/elasticsearch-transform-index-using-scripted-fields/249385 "2020-09-29T07:12:30Z")

</div>

I am using Elasic Cloud v7.5. I created two scripted fields. I am able to search and aggregate on the fields. I tried to transform to new index using the aggregate of scripted fields but the values are coming as zero in …

---

## [RAM/ Heap requirements for Elastic stack](https://discuss.elastic.co/t/ram-heap-requirements-for-elastic-stack/250295)

<div class="topic-metadata">

**Author:** [@Madhu19](https://discuss.elastic.co/u/Madhu19)\
**Replies:** 2\
**Last updated:** [September 29, 2020, 6:52am UTC](https://discuss.elastic.co/t/ram-heap-requirements-for-elastic-stack/250295 "2020-09-29T06:52:12Z")

</div>

I have setup ELK for watching logs on Kibana on Linux redhat-6.8 with 16gb RAM and allocated 6GB for Heap. Index size is 1.5gb per day with 7 days retention period. Observed when I query with very simple patterns on Kiba…

---

## [Large numbers in KQL is difficult](https://discuss.elastic.co/t/large-numbers-in-kql-is-difficult/249935)

<div class="topic-metadata">

**Author:** [@bodo.te](https://discuss.elastic.co/u/bodo.te)\
**Replies:** 1\
**Last updated:** [September 29, 2020, 6:32am UTC](https://discuss.elastic.co/t/large-numbers-in-kql-is-difficult/249935 "2020-09-29T06:32:52Z")

</div>

Hi , I want to query "event.duration" with KQL. Problem is: event.duration is in nano sec, but since I am querying "Mysql Slow Queries" im interested e.g. is a query like this : event.duration \> 180000000000 which…

---

## [Kibana users](https://discuss.elastic.co/t/kibana-users/250159)

<div class="topic-metadata">

**Author:** [@Shalinicts](https://discuss.elastic.co/u/Shalinicts)\
**Replies:** 7\
**Last updated:** [September 29, 2020, 6:25am UTC](https://discuss.elastic.co/t/kibana-users/250159 "2020-09-29T06:25:53Z")

</div>

where is kibana users get stored.How to retrieve if kibana pod gets deleted in elastic cloud

---

## [Kibana and ADA compliance](https://discuss.elastic.co/t/kibana-and-ada-compliance/250093)

<div class="topic-metadata">

**Author:** [@Purnima\_Dhulipudi](https://discuss.elastic.co/u/Purnima_Dhulipudi)\
**Replies:** 4\
**Last updated:** [September 29, 2020, 6:18am UTC](https://discuss.elastic.co/t/kibana-and-ada-compliance/250093 "2020-09-29T06:18:27Z")

</div>

Hi We started a POC using Elastic stack and used Kibana to build visulizations and dashboards. Our requirement is the dashboards should meet ADA (American Disability Act) standards Is Kibana ADA compliant or not, Plea…

---

## [Unable to apply base Elasticsearch kubernetes image](https://discuss.elastic.co/t/unable-to-apply-base-elasticsearch-kubernetes-image/250231)

<div class="topic-metadata">

**Author:** [@jdevilla20](https://discuss.elastic.co/u/jdevilla20)\
**Replies:** 3\
**Last updated:** [September 29, 2020, 5:47am UTC](https://discuss.elastic.co/t/unable-to-apply-base-elasticsearch-kubernetes-image/250231 "2020-09-29T05:47:14Z")

</div>

Hi I am trying to apply the Elasticsearch Docker image. I am trying to use the instructions defined here: When I run an "kubectl apply -f" on the yaml, I get an error: error: unable to recognize "test.yaml": no mat…

---

## [Fscrawler does not index to ES with https](https://discuss.elastic.co/t/fscrawler-does-not-index-to-es-with-https/247522)

<div class="topic-metadata">

**Author:** [@Yamini\_Shashank](https://discuss.elastic.co/u/Yamini_Shashank)\
**Replies:** 3\
**Last updated:** [September 29, 2020, 5:29am UTC](https://discuss.elastic.co/t/fscrawler-does-not-index-to-es-with-https/247522 "2020-09-29T05:29:28Z")

</div>

The following is the configuration on fscrawler: name: "docscluster" fs: url: "/etc/STORE/" update\_rate: "2s" excludes: - "\*/~\*" json\_support: false filename\_as\_id: true add\_filesize: true remove\_deleted…

---

## [Does running multiple logstash instance is a good idea?](https://discuss.elastic.co/t/does-running-multiple-logstash-instance-is-a-good-idea/250284)

<div class="topic-metadata">

**Author:** [@Kambing](https://discuss.elastic.co/u/Kambing)\
**Replies:** 1\
**Last updated:** [September 29, 2020, 4:43am UTC](https://discuss.elastic.co/t/does-running-multiple-logstash-instance-is-a-good-idea/250284 "2020-09-29T04:43:48Z")

</div>

Hi, Currently I'm running multiple instance of filebeat in my production environment, each filebeat module have it's own instance, so when I need to change the configuration on specific module, I'll not bother other modu…

---

## [java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit](https://discuss.elastic.co/t/java-lang-illegalstateexception-logstash-stopped-processing-because-of-an-error-systemexit-exit/249918)

<div class="topic-metadata">

**Author:** [@Rajan\_Gupta](https://discuss.elastic.co/u/Rajan_Gupta)\
**Replies:** 4\
**Last updated:** [September 29, 2020, 4:22am UTC](https://discuss.elastic.co/t/java-lang-illegalstateexception-logstash-stopped-processing-because-of-an-error-systemexit-exit/249918 "2020-09-29T04:22:39Z")

</div>

Hi There, Got Stuck from last three days. I m getting this error while starting the logstash. Could anyone help me on this.Stack trace is defined below :- Sending Logstash logs to D:/Elasticsearch/logstash-7.9.1/logs …

---

## [Getting error SSLConnectionSocketFactory not found in packages?](https://discuss.elastic.co/t/getting-error-sslconnectionsocketfactory-not-found-in-packages/249902)

<div class="topic-metadata">

**Author:** [@talbehat](https://discuss.elastic.co/u/talbehat)\
**Replies:** 4\
**Last updated:** [September 29, 2020, 4:04am UTC](https://discuss.elastic.co/t/getting-error-sslconnectionsocketfactory-not-found-in-packages/249902 "2020-09-29T04:04:30Z")

</div>

NameError: SSLConnectionSocketFactory not found in packages org.apache.http.client.methods, org.apache.http.client.entity, org.apache.http.client.config, org.apache.http.config, org.apache.http.conn.socket, org.apache.ht…

---

## [Map nested field into DB output using Elastic input plugin](https://discuss.elastic.co/t/map-nested-field-into-db-output-using-elastic-input-plugin/250176)

<div class="topic-metadata">

**Author:** [@jasoninmel](https://discuss.elastic.co/u/jasoninmel)\
**Replies:** 6\
**Last updated:** [September 29, 2020, 3:54am UTC](https://discuss.elastic.co/t/map-nested-field-into-db-output-using-elastic-input-plugin/250176 "2020-09-29T03:54:20Z")

</div>

Hi there, I'm using Logstash as a ETL tool to copy data from Elastic index to DB table. I tried to map a nested field using following insert statement in the logstash configuration; statement =\> \["INSERT into assets (i…

---

## [Logstash connectivity to MYSQL in open source ELK](https://discuss.elastic.co/t/logstash-connectivity-to-mysql-in-open-source-elk/250278)

<div class="topic-metadata">

**Author:** [@DG13](https://discuss.elastic.co/u/DG13)\
**Replies:** 3\
**Last updated:** [September 29, 2020, 3:54am UTC](https://discuss.elastic.co/t/logstash-connectivity-to-mysql-in-open-source-elk/250278 "2020-09-29T03:54:10Z")

</div>

Is the MYSQL connectivity to Logstash available in open source ELK stack ? Thanks,

---

## [\[Path.data\]](https://discuss.elastic.co/t/path-data/250177)

<div class="topic-metadata">

**Author:** [@Guillaume\_RENARD](https://discuss.elastic.co/u/Guillaume_RENARD)\
**Replies:** 1\
**Last updated:** [September 29, 2020, 3:32am UTC](https://discuss.elastic.co/t/path-data/250177 "2020-09-29T03:32:04Z")

</div>

Hello, I have to path.data path.data: \["/datassd/elasticsearch", "/data/elasticsearch"\] but one is quite small and always full, I want ot not use it anymore and to only use one. is it possible to remove it from con…

---

## [ElasticSearch connection to Tableau in open source ELK](https://discuss.elastic.co/t/elasticsearch-connection-to-tableau-in-open-source-elk/250273)

<div class="topic-metadata">

**Author:** [@DG13](https://discuss.elastic.co/u/DG13)\
**Replies:** 3\
**Last updated:** [September 29, 2020, 2:52am UTC](https://discuss.elastic.co/t/elasticsearch-connection-to-tableau-in-open-source-elk/250273 "2020-09-29T02:52:46Z")

</div>

Hi , ElasticSearch Tableau connectivity enabled in open sourceELK stack as well ? I am following this link - https://www.elastic.co/guide/en/elasticsearch/reference/7.9/sql-client-apps-tableau-desktop.html However get…

---

## [Logstash Avro data points are resulting into default value instead of the value from kafka output](https://discuss.elastic.co/t/logstash-avro-data-points-are-resulting-into-default-value-instead-of-the-value-from-kafka-output/250275)

<div class="topic-metadata">

**Author:** [@mastersmit](https://discuss.elastic.co/u/mastersmit)\
**Replies:** 0\
**Last updated:** [September 29, 2020, 2:33am UTC](https://discuss.elastic.co/t/logstash-avro-data-points-are-resulting-into-default-value-instead-of-the-value-from-kafka-output/250275 "2020-09-29T02:33:55Z")

</div>

Logstash output: { "timestamp" =\> 0, "username" =\> "", "tweet" =\> "", "@version" =\> "1", "@timestamp" =\> 2020-09-29T01:59:15.867Z } Kafka Consumer output: {"username":"John Smith","tweet"…

---

## [Logstash aggregate array of objects based on key field](https://discuss.elastic.co/t/logstash-aggregate-array-of-objects-based-on-key-field/250249)

<div class="topic-metadata">

**Author:** [@rfferrao](https://discuss.elastic.co/u/rfferrao)\
**Replies:** 5\
**Last updated:** [September 29, 2020, 12:11am UTC](https://discuss.elastic.co/t/logstash-aggregate-array-of-objects-based-on-key-field/250249 "2020-09-29T00:11:22Z")

</div>

I'm receiving some logs like these: datetime="2020-09-2020T14:40:00-0300" action="tunnel-up" tunneltype="ssl-tunnel" tunnelid=1171992131 remip=192.168.0.1 user="someuser" group="vpn\_ssl\_group" and datetime="2020-09-20…

---

## [Problem with EQL queries](https://discuss.elastic.co/t/problem-with-eql-queries/250266)

<div class="topic-metadata">

**Author:** [@Yenii\_Ceri](https://discuss.elastic.co/u/Yenii_Ceri)\
**Replies:** 0\
**Last updated:** [September 28, 2020, 11:22pm UTC](https://discuss.elastic.co/t/problem-with-eql-queries/250266 "2020-09-28T23:22:17Z")

</div>

Hey I have an issue with EQL queries on Elasticsearch. I have a basic ES license with xpack enabled, in addition to some Winlogbeat indexes with ECS syntax. However, I don't get any hit when I execute some EQL queries…

---

## [How to see the requests that will come to elasticsearch?](https://discuss.elastic.co/t/how-to-see-the-requests-that-will-come-to-elasticsearch/250172)

<div class="topic-metadata">

**Author:** [@aleksandr555](https://discuss.elastic.co/u/aleksandr555)\
**Replies:** 1\
**Last updated:** [September 28, 2020, 11:20pm UTC](https://discuss.elastic.co/t/how-to-see-the-requests-that-will-come-to-elasticsearch/250172 "2020-09-28T23:20:33Z")

</div>

Hello, at the moment we are using an elasticsearch cluster consisting of 3 master nodes and 15 data nodes, elasticsearch version 7.5.2, kibana version 7.5.2, please tell me if it is possible to monitor requests coming to…

---

## [Infor required](https://discuss.elastic.co/t/infor-required/250185)

<div class="topic-metadata">

**Author:** [@balajiduddu](https://discuss.elastic.co/u/balajiduddu)\
**Replies:** 1\
**Last updated:** [September 28, 2020, 11:04pm UTC](https://discuss.elastic.co/t/infor-required/250185 "2020-09-28T23:04:11Z")

</div>

Hi , We are planning to update Elastic search to 7.9.1. So can we use the JAVA API of version 2.4.0 to perform operations on EL if not which version of JAVA API we have to use to perform operations of EL Thanks, Balaj…

---

## [Get index mapping from a snapshot](https://discuss.elastic.co/t/get-index-mapping-from-a-snapshot/250216)

<div class="topic-metadata">

**Author:** [@Robert\_Ga](https://discuss.elastic.co/u/Robert_Ga)\
**Replies:** 1\
**Last updated:** [September 28, 2020, 10:58pm UTC](https://discuss.elastic.co/t/get-index-mapping-from-a-snapshot/250216 "2020-09-28T22:58:44Z")

</div>

Hi everyone! I am curious if I can retrieve only the mapping of an index which is present inside a cluster snapshot without restoring that snapshot. I know that I can restore only one index and then get the mapping for …

---

## [Information about users that will become paying](https://discuss.elastic.co/t/information-about-users-that-will-become-paying/250164)

<div class="topic-metadata">

**Author:** [@boksimon](https://discuss.elastic.co/u/boksimon)\
**Replies:** 3\
**Last updated:** [September 28, 2020, 10:49pm UTC](https://discuss.elastic.co/t/information-about-users-that-will-become-paying/250164 "2020-09-28T22:49:18Z")

</div>

Hi, We are indexing events performed by our users in an effort to create a better service. Each event is indexed into elasticsearch in real time, and we have a couple of dashboards visualizing the common actions. An exa…

---

## [Aggregation Based on File Path](https://discuss.elastic.co/t/aggregation-based-on-file-path/250254)

<div class="topic-metadata">

**Author:** [@NomadicCodeGuy](https://discuss.elastic.co/u/NomadicCodeGuy)\
**Replies:** 1\
**Last updated:** [September 28, 2020, 8:24pm UTC](https://discuss.elastic.co/t/aggregation-based-on-file-path/250254 "2020-09-28T20:24:20Z")

</div>

I need to combine "errorInfo" fields of events that share nothing in common except for their file path. The field "log.file.path" exists as a field for my data in kibana but am not sure if a field needs to be explicitly …

---

## [Exact match with multiple names from OSM elements](https://discuss.elastic.co/t/exact-match-with-multiple-names-from-osm-elements/250257)

<div class="topic-metadata">

**Author:** [@HarelM](https://discuss.elastic.co/u/HarelM)\
**Replies:** 0\
**Last updated:** [September 28, 2020, 7:17pm UTC](https://discuss.elastic.co/t/exact-match-with-multiple-names-from-osm-elements/250257 "2020-09-28T19:17:29Z")

</div>

OK, so this might be a long intro but stay with me... I've built a OSM names search engine, a bit like Nominatim, but better (at least for my site's needs). I'm basically indexing everything that has a name in OSM. Th…

---

## [Kibana PUT request timing out](https://discuss.elastic.co/t/kibana-put-request-timing-out/250198)

<div class="topic-metadata">

**Author:** [@awstrain34](https://discuss.elastic.co/u/awstrain34)\
**Replies:** 3\
**Last updated:** [September 28, 2020, 6:02pm UTC](https://discuss.elastic.co/t/kibana-put-request-timing-out/250198 "2020-09-28T18:02:56Z")

</div>

Hello All, I am running an Elastic search and Kibana 6.1.1 on Kubernetes with docker containers. I have configured s3-repository plugin for backup. I am trying to create a backup from Kibana of indice with size 5gb: …

---

## [Questions about upgrading ES 6 -\> 7](https://discuss.elastic.co/t/questions-about-upgrading-es-6-7/250238)

<div class="topic-metadata">

**Author:** [@rdragan](https://discuss.elastic.co/u/rdragan)\
**Replies:** 1\
**Last updated:** [September 28, 2020, 5:53pm UTC](https://discuss.elastic.co/t/questions-about-upgrading-es-6-7/250238 "2020-09-28T17:53:51Z")

</div>

Hey, We are planning to do an online 6-\>7 upgrade for our ES clusters, and we are looking into ways of rolling back safely from 7 to 6 in case something bad happens. The ES docs state that once the upgrade starts, the E…

[Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1779)

[Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1781)
