# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1783 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1784 --- ## [Elastic search gives exception '"too\_many\_buckets\_exception" not able to catch it in high level rest client](https://discuss.elastic.co/t/elastic-search-gives-exception-too-many-buckets-exception-not-able-to-catch-it-in-high-level-rest-client/250120)
**Author:** [@charvi23](https://discuss.elastic.co/u/charvi23)\ **Replies:** 0\ **Last updated:** [September 28, 2020, 4:29am UTC](https://discuss.elastic.co/t/elastic-search-gives-exception-too-many-buckets-exception-not-able-to-catch-it-in-high-level-rest-client/250120 "2020-09-28T04:29:13Z")
I am trying to create a table using elastic search, but I get the following exception at times when the count of my bucket increases the limit. I am fine to have this exception as long I am able to send it to user that t… --- ## [At least one primary shard for the index \[.security-7\] is unavailable](https://discuss.elastic.co/t/at-least-one-primary-shard-for-the-index-security-7-is-unavailable/249508)
**Author:** [@naveenj](https://discuss.elastic.co/u/naveenj)\ **Replies:** 4\ **Last updated:** [September 28, 2020, 4:28am UTC](https://discuss.elastic.co/t/at-least-one-primary-shard-for-the-index-security-7-is-unavailable/249508 "2020-09-28T04:28:25Z")
Getting bellow error but elastic and kibana both working fine. Let me know the issue? org.elasticsearch.action.UnavailableShardsException: at least one primary shard for the index \[.security-7\] is unavailable at org.el… --- ## [Authen to elastic with ldap config on which nodes?](https://discuss.elastic.co/t/authen-to-elastic-with-ldap-config-on-which-nodes/249894)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 3\ **Last updated:** [September 28, 2020, 3:55am UTC](https://discuss.elastic.co/t/authen-to-elastic-with-ldap-config-on-which-nodes/249894 "2020-09-28T03:55:53Z")
Hi all I have been testing for the feature to authen mine elastic server with ldap with one of my testing server, now i want to deploy it on the whole cluster, so which nodes do i have to config to get the feature worki… --- ## [Unable to install and start the elasticsearch in RHEL 7 due to polkit error](https://discuss.elastic.co/t/unable-to-install-and-start-the-elasticsearch-in-rhel-7-due-to-polkit-error/249847)
**Author:** [@aknraj](https://discuss.elastic.co/u/aknraj)\ **Replies:** 1\ **Last updated:** [September 28, 2020, 3:51am UTC](https://discuss.elastic.co/t/unable-to-install-and-start-the-elasticsearch-in-rhel-7-due-to-polkit-error/249847 "2020-09-28T03:51:15Z")
I am unable to start hte elasticsearch after the installation due to the below error. I have tried multiple options as recommended in other topics like reinstalling, enusing right java\_home, giving full permissions, but … --- ## [Filebeat.exe allocates too much memory on Windows server 2016](https://discuss.elastic.co/t/filebeat-exe-allocates-too-much-memory-on-windows-server-2016/249887)
**Author:** [@petertw6235](https://discuss.elastic.co/u/petertw6235)\ **Replies:** 1\ **Last updated:** [September 28, 2020, 3:46am UTC](https://discuss.elastic.co/t/filebeat-exe-allocates-too-much-memory-on-windows-server-2016/249887 "2020-09-28T03:46:57Z")
Dear Sir: We use filebeat to parse our log and send the data to kafka -\> logstash -\> elasticsearch. But we found the memory consumed by filebeat.exe was over 1.6Gb. We also check the filebeat log. {"monitoring": {"… --- ## [Elasticsearch cluster and 2 servers went down](https://discuss.elastic.co/t/elasticsearch-cluster-and-2-servers-went-down/249898)
**Author:** [@rohitarorait82](https://discuss.elastic.co/u/rohitarorait82)\ **Replies:** 1\ **Last updated:** [September 28, 2020, 3:46am UTC](https://discuss.elastic.co/t/elasticsearch-cluster-and-2-servers-went-down/249898 "2020-09-28T03:46:06Z")
Hi Team, I have 6 server cluster with 5 data node and 1 coordinating node , 2 of the server went completely down because of the heavy load. On one server even telnet is not working on 22 port and on the other sever whe… --- ## [How can we get list of programs/softwares installed in a Windows server/endpoint?](https://discuss.elastic.co/t/how-can-we-get-list-of-programs-softwares-installed-in-a-windows-server-endpoint/249904)
**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\ **Replies:** 0\ **Last updated:** [September 25, 2020, 5:16am UTC](https://discuss.elastic.co/t/how-can-we-get-list-of-programs-softwares-installed-in-a-windows-server-endpoint/249904 "2020-09-25T05:16:55Z")
After doing some basic tests, I couldn't find if the Windows client would put list of softwares into the Windows EventLog. Is there an option to run a script or execution in any of the beats on the target client? it co… --- ## [How to increase disk size for Elastic search](https://discuss.elastic.co/t/how-to-increase-disk-size-for-elastic-search/249925)
**Author:** [@pnamburi](https://discuss.elastic.co/u/pnamburi)\ **Replies:** 1\ **Last updated:** [September 28, 2020, 3:44am UTC](https://discuss.elastic.co/t/how-to-increase-disk-size-for-elastic-search/249925 "2020-09-28T03:44:25Z")
I just executed the below command which returned the elastic search disk space GET \_cat/nodes?v&h=id,diskTotal,diskUsed,diskAvail,diskUsedPercent Output: id diskTotal diskUsed diskAvail diskUsedPercent qzxs 9.6gb 8.7… --- ## [Unauthorized to indices:admin/settings/update](https://discuss.elastic.co/t/unauthorized-to-indices-admin-settings-update/249987)
**Author:** [@ffknob](https://discuss.elastic.co/u/ffknob)\ **Replies:** 0\ **Last updated:** [September 25, 2020, 2:10pm UTC](https://discuss.elastic.co/t/unauthorized-to-indices-admin-settings-update/249987 "2020-09-25T14:10:14Z")
Hello do you know what privilege I have to include in a role in order for this user to be able to execute that action? \[2020-09-24T19:47:08,114\]\[ERROR\]\[o.e.x.i.IndexLifecycleRunner\] \[node01\] policy \[apm-rollover-30-day… --- ## [If i try to Add search search.max\_buckets then getting below error CURL -XGET "http://localhost:9200/\_cluster/settings {"persistent":{},"transient":{"search.max\_buckets": 200000}} curl: (3) \[globbing\] nested brace in column 53](https://discuss.elastic.co/t/if-i-try-to-add-search-search-max-buckets-then-getting-below-error-curl-xget-http-localhost-9200-cluster-settings-persistent-transient-search-max-buckets-200000-curl-3-globbing-nested-brace-in-column-53/250004)
**Author:** [@Suparna\_Shankar](https://discuss.elastic.co/u/Suparna_Shankar)\ **Replies:** 1\ **Last updated:** [September 28, 2020, 3:38am UTC](https://discuss.elastic.co/t/if-i-try-to-add-search-search-max-buckets-then-getting-below-error-curl-xget-http-localhost-9200-cluster-settings-persistent-transient-search-max-buckets-200000-curl-3-globbing-nested-brace-in-column-53/250004 "2020-09-28T03:38:06Z")
if i try to Add search search.max\_buckets then getting below error CURL -XGET "http://localhost:9200/\_cluster/settings {"persistent":{},"transient":{"search.max\_buckets": 200000}} curl: (3) \[globbing\] nested brace in col… --- ## [Failed to parse the field](https://discuss.elastic.co/t/failed-to-parse-the-field/250026)
**Author:** [@Ramalakshmi](https://discuss.elastic.co/u/Ramalakshmi)\ **Replies:** 1\ **Last updated:** [September 28, 2020, 3:35am UTC](https://discuss.elastic.co/t/failed-to-parse-the-field/250026 "2020-09-28T03:35:55Z")
Hi I am sending logs to kibana using filebeat ,and I am facing below error while sending logs .Some of the events doesn't have host in raw data facing error for that events. \[2020-09-24T09:20:40,591\]\[WARN \]\[logstash.ou… --- ## [Get histogram of documents per hour per term](https://discuss.elastic.co/t/get-histogram-of-documents-per-hour-per-term/250106)
**Author:** [@pocorschi](https://discuss.elastic.co/u/pocorschi)\ **Replies:** 1\ **Last updated:** [September 28, 2020, 3:28am UTC](https://discuss.elastic.co/t/get-histogram-of-documents-per-hour-per-term/250106 "2020-09-28T03:28:40Z")
Hi everybody. Been looking around for a while trying to come up with an answer to this but no luck so far. My documents are simple. One timestamp and one device\_id. Given a start and end date, I would want to get a hist… --- ## [Not able to start elasticsearch](https://discuss.elastic.co/t/not-able-to-start-elasticsearch/250018)
**Author:** [@pradnya\_05](https://discuss.elastic.co/u/pradnya_05)\ **Replies:** 1\ **Last updated:** [September 28, 2020, 3:23am UTC](https://discuss.elastic.co/t/not-able-to-start-elasticsearch/250018 "2020-09-28T03:23:44Z")
I have just started reading about elasticsearch concept so I am new in this concept. I have downloaded zip file of elasticseach as I am using windows. But after running batch file from cmd with admin access, getting exce… --- ## [Licensing DEV and CONS Nodes](https://discuss.elastic.co/t/licensing-dev-and-cons-nodes/249999)
**Author:** [@northwine](https://discuss.elastic.co/u/northwine)\ **Replies:** 1\ **Last updated:** [September 28, 2020, 1:30am UTC](https://discuss.elastic.co/t/licensing-dev-and-cons-nodes/249999 "2020-09-28T01:30:29Z")
Hi, i have found a note in this post regarding the licensing of dev environments (in addition to allready licensed prod nodes). Where can I find a reference that there is no need for additional licenses for DEV / CONS n… --- ## [Elastic 401 error with xpack security off](https://discuss.elastic.co/t/elastic-401-error-with-xpack-security-off/250085)
**Author:** [@jividi](https://discuss.elastic.co/u/jividi)\ **Replies:** 0\ **Last updated:** [September 27, 2020, 12:48pm UTC](https://discuss.elastic.co/t/elastic-401-error-with-xpack-security-off/250085 "2020-09-27T12:48:02Z")
Hi, I have an elastic 7.8 on docker that I want to connect to it from a remote server on the internet with the domain, I have several other local vms that connects to logstash and logstash works fine with local IP but I … --- ## [Please Help Newbie with default auditbeat YML did not find expected key?](https://discuss.elastic.co/t/please-help-newbie-with-default-auditbeat-yml-did-not-find-expected-key/250101)
**Author:** [@tonysue](https://discuss.elastic.co/u/tonysue)\ **Replies:** 5\ **Last updated:** [September 28, 2020, 1:11am UTC](https://discuss.elastic.co/t/please-help-newbie-with-default-auditbeat-yml-did-not-find-expected-key/250101 "2020-09-28T01:11:19Z")
Default auditbeat YML has the following error prevented from setup and execute. PS C:\\Program Files\\auditbeat\> ./auditbeat setup ./auditbeat -e ./auditbeat : Exiting: error loading config file: yaml: line 102: did not… --- ## [Upgrade elasticsearch](https://discuss.elastic.co/t/upgrade-elasticsearch/249491)
**Author:** [@blomqc](https://discuss.elastic.co/u/blomqc)\ **Replies:** 3\ **Last updated:** [September 28, 2020, 12:34am UTC](https://discuss.elastic.co/t/upgrade-elasticsearch/249491 "2020-09-28T00:34:33Z")
after upgrading elasticsearch binaries from 1.7.x to 2.x, elasticsearch takes very long (~20h) get back online. From the log it looks like data is moved around ? Only seen this issue when elasticsearch is configured wi… --- ## [Unable to get the Username and Roles in Kibana 7.9 through the Legacy and New Platforms](https://discuss.elastic.co/t/unable-to-get-the-username-and-roles-in-kibana-7-9-through-the-legacy-and-new-platforms/249296)
**Author:** [@BitBite](https://discuss.elastic.co/u/BitBite)\ **Replies:** 9\ **Last updated:** [September 27, 2020, 10:27pm UTC](https://discuss.elastic.co/t/unable-to-get-the-username-and-roles-in-kibana-7-9-through-the-legacy-and-new-platforms/249296 "2020-09-27T22:27:41Z")
We have to upgrade to ELK 7.9 and I've been unable to retrieve user details from a Kibana plugin on both the LP and NP. Ideally there's a way to get this working on the Legacy Platform which would provide time to perfor… --- ## [Browser Displays Text (No Dashboard)](https://discuss.elastic.co/t/browser-displays-text-no-dashboard/250067)
**Author:** [@LogMonitor](https://discuss.elastic.co/u/LogMonitor)\ **Replies:** 5\ **Last updated:** [September 27, 2020, 8:21pm UTC](https://discuss.elastic.co/t/browser-displays-text-no-dashboard/250067 "2020-09-27T20:21:43Z")
I am new to ELK. I have an ESXI environment and I created a single-node ELK stack using this guide: https://burnhamforensics.com/2018/08/14/creating-a-single-node-elk-stack/. When I access the URL (http://192.168.1.12:9… --- ## [How to run couchbase queries (n1ql) in logstash](https://discuss.elastic.co/t/how-to-run-couchbase-queries-n1ql-in-logstash/249564)
**Author:** [@puja](https://discuss.elastic.co/u/puja)\ **Replies:** 2\ **Last updated:** [September 27, 2020, 6:23pm UTC](https://discuss.elastic.co/t/how-to-run-couchbase-queries-n1ql-in-logstash/249564 "2020-09-27T18:23:05Z")
Hi, I am using 7.7.0 version of ELK stack. I am able to run sql, postgres and oracle queries in logstash using jdbc but I am stuck while doing the same for couchbase. Please suggest me how to run couchbase queries in … --- ## [Script for a Force Merge on indexes in ES](https://discuss.elastic.co/t/script-for-a-force-merge-on-indexes-in-es/250021)
**Author:** [@elasticuserxxx](https://discuss.elastic.co/u/elasticuserxxx)\ **Replies:** 1\ **Last updated:** [September 27, 2020, 6:04pm UTC](https://discuss.elastic.co/t/script-for-a-force-merge-on-indexes-in-es/250021 "2020-09-27T18:04:26Z")
I need to run force merge on indexes which are older (no longer being written to or not in active state) for more than "48hours for daily/quaterly indexes" and "33 days for monthly indexes". This should be run by a scri… --- ## [Tagging data based on lookup table](https://discuss.elastic.co/t/tagging-data-based-on-lookup-table/250097)
**Author:** [@Adi\_Pacht](https://discuss.elastic.co/u/Adi_Pacht)\ **Replies:** 0\ **Last updated:** [September 27, 2020, 5:09pm UTC](https://discuss.elastic.co/t/tagging-data-based-on-lookup-table/250097 "2020-09-27T17:09:48Z")
Hey everyone, I’m trying to tag my data according to a lookup table. The lookup table has these fields: • Key- represent the field name in the data I want to tag. In the real data the field is a subfield of “Headers”… --- ## [Kibana 403 forbidden](https://discuss.elastic.co/t/kibana-403-forbidden/250089)
**Author:** [@111380](https://discuss.elastic.co/u/111380)\ **Replies:** 1\ **Last updated:** [September 27, 2020, 4:41pm UTC](https://discuss.elastic.co/t/kibana-403-forbidden/250089 "2020-09-27T16:41:04Z")
Hi! After creating passwords "./elasticsearch-setup-password auto" it is impossible to log in to kibana, error 403 forbidden /etc/kibana/kibana.yml: elasticsearch.username: "kibana" elasticsearch.password: "password" … --- ## [ES is not starting after upgrading it to 7.9.2](https://discuss.elastic.co/t/es-is-not-starting-after-upgrading-it-to-7-9-2/250081)
**Author:** [@NiranjanMurali](https://discuss.elastic.co/u/NiranjanMurali)\ **Replies:** 8\ **Last updated:** [September 27, 2020, 2:37pm UTC](https://discuss.elastic.co/t/es-is-not-starting-after-upgrading-it-to-7-9-2/250081 "2020-09-27T14:37:14Z")
Elasticsearch is not starting after updating it to 7.9.2. It throws below error. OS-CentOS7 Exception in thread "main" java.lang.RuntimeException: starting java failed with \[1\] output: error: Unrecognized VM option … --- ## [Scoring individual documents](https://discuss.elastic.co/t/scoring-individual-documents/250090)
**Author:** [@thernstig](https://discuss.elastic.co/u/thernstig)\ **Replies:** 0\ **Last updated:** [September 27, 2020, 1:56pm UTC](https://discuss.elastic.co/t/scoring-individual-documents/250090 "2020-09-27T13:56:55Z")
I understand that Elasticsearch is a great database to search amongst documents and to score them amongst eachother, thus being able to return to most relevant document for the search. But I want to use Elasticsearch in… --- ## [Httpjson Crawler is not compatible with the --once option](https://discuss.elastic.co/t/httpjson-crawler-is-not-compatible-with-the-once-option/250077)
**Author:** [@XhstormR](https://discuss.elastic.co/u/XhstormR)\ **Replies:** 0\ **Last updated:** [September 27, 2020, 10:31am UTC](https://discuss.elastic.co/t/httpjson-crawler-is-not-compatible-with-the-once-option/250077 "2020-09-27T10:31:24Z")
I use filebeat's httpjson inputs to export elasticsearch index data, D:\\Download\\filebeat-7.9.2-windows-x86\_64\>filebeat.exe run -e -c 2.yml 2020-09-27T18:24:01.195+0800 INFO \[httpjson\] httpjson/input.go:471 … --- ## [Create visualize exactly with field values](https://discuss.elastic.co/t/create-visualize-exactly-with-field-values/250062)
**Author:** [@arp220](https://discuss.elastic.co/u/arp220)\ **Replies:** 1\ **Last updated:** [September 27, 2020, 9:36am UTC](https://discuss.elastic.co/t/create-visualize-exactly-with-field-values/250062 "2020-09-27T09:36:12Z")
Hi. We have filed elapse and values are in milliseconds. Now we want to create a visualize Area or TSVB (time series) with exactly elapse values and not Aggregations, we don't want to use count or max or average or etc,… --- ## [Elasticsearch cross-index query with aggregations](https://discuss.elastic.co/t/elasticsearch-cross-index-query-with-aggregations/249100)
**Author:** [@ArtemSavelev](https://discuss.elastic.co/u/ArtemSavelev)\ **Replies:** 1\ **Last updated:** [September 26, 2020, 11:22pm UTC](https://discuss.elastic.co/t/elasticsearch-cross-index-query-with-aggregations/249100 "2020-09-26T23:22:10Z")
I use: Elasticsearch 7.7 , Kibana 7.7 For example, lets take two indexes: User index with simple mapping: PUT /user\_index { "mappings": { "properties": { "user\_id": { "type": "text" }, "user\_phone… --- ## [Monitor failed elastic user logins](https://discuss.elastic.co/t/monitor-failed-elastic-user-logins/250045)
**Author:** [@borna\_talebi](https://discuss.elastic.co/u/borna_talebi)\ **Replies:** 1\ **Last updated:** [September 26, 2020, 10:54pm UTC](https://discuss.elastic.co/t/monitor-failed-elastic-user-logins/250045 "2020-09-26T22:54:39Z")
Hi, I was wondering if there is a way to temporarily ban an IP or even a user profile who entered its password wrong for N time. In general, is there a way to monitor user login attempts and automatically act upon it? --- ## [Beats direction: ingest pipeline vs. local input modifications](https://discuss.elastic.co/t/beats-direction-ingest-pipeline-vs-local-input-modifications/250063)
**Author:** [@jessvin.thomas](https://discuss.elastic.co/u/jessvin.thomas)\ **Replies:** 0\ **Last updated:** [September 26, 2020, 4:35pm UTC](https://discuss.elastic.co/t/beats-direction-ingest-pipeline-vs-local-input-modifications/250063 "2020-09-26T16:35:06Z")
When using a filebeat module, some data manipulations seem to be done in two places: In an ingest pipeline in filebeat at input using filebeat/module/\[modulename\]/\[module-sub\]/config/...yml. This seems to be opposite … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1782) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1784)