# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1796 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1797 --- ## [How to calculate time difference across multi-layer nested structure](https://discuss.elastic.co/t/how-to-calculate-time-difference-across-multi-layer-nested-structure/248794)
**Author:** [@Fan\_Y102](https://discuss.elastic.co/u/Fan_Y102)\ **Replies:** 2\ **Last updated:** [September 21, 2020, 1:51am UTC](https://discuss.elastic.co/t/how-to-calculate-time-difference-across-multi-layer-nested-structure/248794 "2020-09-21T01:51:07Z")
Hello Guys, I'm new for Elasticsearch query. Currently, I'm working on a data set contains two layers nested JSON. For example: { "data": \[ { "number": 1, "startDate": "2020-01-08", "finalDate": "2020-01-04", … --- ## [Error in Kibana "xpack =\> unable to get local issuer certificate"](https://discuss.elastic.co/t/error-in-kibana-xpack-unable-to-get-local-issuer-certificate/249226)
**Author:** [@Abhishek\_Kumar7](https://discuss.elastic.co/u/Abhishek_Kumar7)\ **Replies:** 1\ **Last updated:** [September 21, 2020, 12:24am UTC](https://discuss.elastic.co/t/error-in-kibana-xpack-unable-to-get-local-issuer-certificate/249226 "2020-09-21T00:24:47Z")
I have a single node server with ES and Kibana hosted on it. I have put them behind an ELB , under a domain name . Assume :- kibana.xyz.com and elasticsearch.xyz.com I have enabled http ssl in elasticsearch and copy pa… --- ## [Automate rollover for daily indices using ILM](https://discuss.elastic.co/t/automate-rollover-for-daily-indices-using-ilm/249233)
**Author:** [@Akshay\_Pawar](https://discuss.elastic.co/u/Akshay_Pawar)\ **Replies:** 5\ **Last updated:** [September 20, 2020, 10:12pm UTC](https://discuss.elastic.co/t/automate-rollover-for-daily-indices-using-ilm/249233 "2020-09-20T22:12:57Z")
Hello, I am looking into automating rollover using Index lifecycle management for daily indices. I am looking for the pattern as follows so that I would be seamlessly able to search across all three indices rollove… --- ## [Error: Could not find or load main class org.elasticsearch.bootstrap.Elasticsearch - Windows Server 2012 R2 - ElasticSearch 2.1.1](https://discuss.elastic.co/t/error-could-not-find-or-load-main-class-org-elasticsearch-bootstrap-elasticsearch-windows-server-2012-r2-elasticsearch-2-1-1/248921)
**Author:** [@silo](https://discuss.elastic.co/u/silo)\ **Replies:** 1\ **Last updated:** [September 20, 2020, 9:39pm UTC](https://discuss.elastic.co/t/error-could-not-find-or-load-main-class-org-elasticsearch-bootstrap-elasticsearch-windows-server-2012-r2-elasticsearch-2-1-1/248921 "2020-09-20T21:39:26Z")
I am facing this error when i tried to run elasticsearch.bat file. I have verified the JAVA\_HOME environment variable. But still the above error persists. --- ## [Index template and JVM usage](https://discuss.elastic.co/t/index-template-and-jvm-usage/249071)
**Author:** [@probson](https://discuss.elastic.co/u/probson)\ **Replies:** 1\ **Last updated:** [September 20, 2020, 9:36pm UTC](https://discuss.elastic.co/t/index-template-and-jvm-usage/249071 "2020-09-20T21:36:21Z")
Hi, We have a number of indexs for devices with limited static fields, ie a firewall. (assuming an upgrade of the device does not add more fields) I typically use the ECS as the template for the indexs. Would there b… --- ## [Read Only Repo FTP with username, password](https://discuss.elastic.co/t/read-only-repo-ftp-with-username-password/249079)
**Author:** [@binhvq](https://discuss.elastic.co/u/binhvq)\ **Replies:** 1\ **Last updated:** [September 20, 2020, 9:34pm UTC](https://discuss.elastic.co/t/read-only-repo-ftp-with-username-password/249079 "2020-09-20T21:34:48Z")
Hi! I'm use ftp for snap shot repo, but i can't find document for ftp repo with port, usename, password for repo. I can find format of url ftp://username:password@server but it's not work. Please help me. --- ## [Error message splitting series by scripted field terms agg](https://discuss.elastic.co/t/error-message-splitting-series-by-scripted-field-terms-agg/249264)
**Author:** [@NiclasK](https://discuss.elastic.co/u/NiclasK)\ **Replies:** 2\ **Last updated:** [September 20, 2020, 9:15pm UTC](https://discuss.elastic.co/t/error-message-splitting-series-by-scripted-field-terms-agg/249264 "2020-09-20T21:15:10Z")
Hi, I added one scripted field. It adds a Category string field based on an existing string field. When I try to split series using terms agg and the scripted field in a bar visualization I get the following error mes… --- ## [Elasticsearch node not responding (ES OSS version 7.6.1)](https://discuss.elastic.co/t/elasticsearch-node-not-responding-es-oss-version-7-6-1/249127)
**Author:** [@DineshNaik](https://discuss.elastic.co/u/DineshNaik)\ **Replies:** 1\ **Last updated:** [September 20, 2020, 9:30pm UTC](https://discuss.elastic.co/t/elasticsearch-node-not-responding-es-oss-version-7-6-1/249127 "2020-09-20T21:30:21Z")
We have an elasticsearch cluster with 3 master and 6 data nodes . Elasticsearch version is 7.6.1(OSS). one of the data node is becoming non-responsive and none of API's (like \_cat, \_cluster/health etc) are working when … --- ## [Storage level in Elasticsearch cluster](https://discuss.elastic.co/t/storage-level-in-elasticsearch-cluster/249196)
**Author:** [@the\_brimix](https://discuss.elastic.co/u/the_brimix)\ **Replies:** 1\ **Last updated:** [September 20, 2020, 9:28pm UTC](https://discuss.elastic.co/t/storage-level-in-elasticsearch-cluster/249196 "2020-09-20T21:28:15Z")
Hi I've a Elasticsearch cluster with 5 nodes. I've this used storage repartition: Node1: 76% Node2: 94% Node3: 88% Node4: 73% Node5: 74% How to do to "leveling" the used storage ? For the node 2 et 3, We arrived … --- ## [Where will I enter from?](https://discuss.elastic.co/t/where-will-i-enter-from/249204)
**Author:** [@falanofilano](https://discuss.elastic.co/u/falanofilano)\ **Replies:** 2\ **Last updated:** [September 20, 2020, 9:26pm UTC](https://discuss.elastic.co/t/where-will-i-enter-from/249204 "2020-09-20T21:26:37Z")
I installed heartbeat on CentOS 7 with the yum package manager. It is running smoothly now. Where or from which port can I access the administration panel? --- ## [Journalbeat: Environment variable in config crashes service](https://discuss.elastic.co/t/journalbeat-environment-variable-in-config-crashes-service/249091)
**Author:** [@alpi-ua](https://discuss.elastic.co/u/alpi-ua)\ **Replies:** 2\ **Last updated:** [September 20, 2020, 9:20pm UTC](https://discuss.elastic.co/t/journalbeat-environment-variable-in-config-crashes-service/249091 "2020-09-20T21:20:31Z")
Hello. Please, help with the issue. Following this reference, I've added following to my config: fields\_under\_root: true fields: hwkey: ${HWKEY} And after restarting the service, constantly receiving: systemctl r… --- ## [Heartbeat (webservice response)](https://discuss.elastic.co/t/heartbeat-webservice-response/249271)
**Author:** [@mustafa.husny](https://discuss.elastic.co/u/mustafa.husny)\ **Replies:** 0\ **Last updated:** [September 20, 2020, 6:22pm UTC](https://discuss.elastic.co/t/heartbeat-webservice-response/249271 "2020-09-20T18:22:18Z")
First my ELK stack version is 7.6.2 My approach is save the heartbeat logs and search in the body.content filed for status code , so i made the following config type: http #SOAP/HTTP id: my-webservice name: my-webs… --- ## [Logstash PQ Java 14 and Closed queue](https://discuss.elastic.co/t/logstash-pq-java-14-and-closed-queue/249242)
**Author:** [@Jugsofbeer](https://discuss.elastic.co/u/Jugsofbeer)\ **Replies:** 0\ **Last updated:** [September 20, 2020, 8:32am UTC](https://discuss.elastic.co/t/logstash-pq-java-14-and-closed-queue/249242 "2020-09-20T08:32:13Z")
Hi, Just wondering if anyone else has struck the issue I have recently with Persistent Queue enabled and the pipeline sometimes getting into a unrecoverable state where it throws the message "cannot write to a closed qu… --- ## [Dynamic input :Http\_poller url](https://discuss.elastic.co/t/dynamic-input-http-poller-url/249277)
**Author:** [@hiba](https://discuss.elastic.co/u/hiba)\ **Replies:** 1\ **Last updated:** [September 20, 2020, 7:42pm UTC](https://discuss.elastic.co/t/dynamic-input-http-poller-url/249277 "2020-09-20T19:42:22Z")
Hi all, in my logstash file i use a http\_poller a input. input { http\_poller { urls =\> { url2020 =\> "http://xxxxx/XXXx/Xxxx/XXXXXXXstartDate=01/01/2020&endDate=30/09/2020" } request\_timeout =\> 60 schedule =\> { "… --- ## [ElasticSearch - how to use search-as-you-type for multivalued fields](https://discuss.elastic.co/t/elasticsearch-how-to-use-search-as-you-type-for-multivalued-fields/249270)
**Author:** [@Ondra\_N](https://discuss.elastic.co/u/Ondra_N)\ **Replies:** 0\ **Last updated:** [September 20, 2020, 5:59pm UTC](https://discuss.elastic.co/t/elasticsearch-how-to-use-search-as-you-type-for-multivalued-fields/249270 "2020-09-20T17:59:37Z")
I am messing around with the newly added search-as-you-type field type. Having documents with following structure doc\_1 ... "nickname": \["Super", "Terrible", "Mediocre"\] ... doc\_2 ... "nickname": \["Grande", "Perfect"… --- ## [Reindexing a document with same version number but with different metadata](https://discuss.elastic.co/t/reindexing-a-document-with-same-version-number-but-with-different-metadata/249268)
**Author:** [@vishnuk](https://discuss.elastic.co/u/vishnuk)\ **Replies:** 1\ **Last updated:** [September 20, 2020, 5:25pm UTC](https://discuss.elastic.co/t/reindexing-a-document-with-same-version-number-but-with-different-metadata/249268 "2020-09-20T17:25:07Z")
Hi, I have the following use case. An admin indexes the existing system during a small maintenance window , all good to go. We plan to use an external version for index document version Users starts using the system a… --- ## [How to Json log format output for my system log](https://discuss.elastic.co/t/how-to-json-log-format-output-for-my-system-log/249238)
**Author:** [@poddraj](https://discuss.elastic.co/u/poddraj)\ **Replies:** 0\ **Last updated:** [September 20, 2020, 7:29am UTC](https://discuss.elastic.co/t/how-to-json-log-format-output-for-my-system-log/249238 "2020-09-20T07:29:00Z")
Hi, I have my log in below format, it actually has all fields delimited by ^. However, in between we can have few other lines which are nothing but the field headers. I am unable to get this log converted into json form… --- ## [Input file plugin - file is not read when modified](https://discuss.elastic.co/t/input-file-plugin-file-is-not-read-when-modified/249228)
**Author:** [@xyz2](https://discuss.elastic.co/u/xyz2)\ **Replies:** 3\ **Last updated:** [September 20, 2020, 2:14am UTC](https://discuss.elastic.co/t/input-file-plugin-file-is-not-read-when-modified/249228 "2020-09-20T02:14:52Z")
HI, I am using file input plugin in logstash. My file gets replaced in regular time interval . I need the file to be read from the beginning each time it is replaced. I have below setting . It reads from beginning onl… --- ## [Applying ILM Policy but data not getting deleted](https://discuss.elastic.co/t/applying-ilm-policy-but-data-not-getting-deleted/248605)
**Author:** [@vikramaddagulla](https://discuss.elastic.co/u/vikramaddagulla)\ **Replies:** 9\ **Last updated:** [September 20, 2020, 2:52am UTC](https://discuss.elastic.co/t/applying-ilm-policy-but-data-not-getting-deleted/248605 "2020-09-20T02:52:01Z")
Hello, I am working on configuring an ILM policy to delete any data in an index which is older than 30 days / more than 50GB. I have an index which has data about 97GB at the moment. I have configured an alias for … --- ## [Logstash error](https://discuss.elastic.co/t/logstash-error/249194)
**Author:** [@grazer](https://discuss.elastic.co/u/grazer)\ **Replies:** 4\ **Last updated:** [September 20, 2020, 1:25am UTC](https://discuss.elastic.co/t/logstash-error/249194 "2020-09-20T01:25:43Z")
Running version 7.8.0 everthing seems to be running fine however, I'm getting error... not sure what it is.. I have the correct java version, all the mutations seem to work, the paths are correct etc.. This extract is fr… --- ## [Coordination Node Where I put them?](https://discuss.elastic.co/t/coordination-node-where-i-put-them/249156)
**Author:** [@Samuel\_Amico](https://discuss.elastic.co/u/Samuel_Amico)\ **Replies:** 7\ **Last updated:** [September 19, 2020, 10:42pm UTC](https://discuss.elastic.co/t/coordination-node-where-i-put-them/249156 "2020-09-19T22:42:17Z")
Guys, I have a doubt. The coordination node, I put at the entrance of the cluster (logstash sends it to the coordination node) or I put it behind the kibana (kibana points to the coordination node). I have 2 coordinatio… --- ## [Get data from elasticsearch and visualize it using python](https://discuss.elastic.co/t/get-data-from-elasticsearch-and-visualize-it-using-python/249221)
**Author:** [@atiqah\_yusri](https://discuss.elastic.co/u/atiqah_yusri)\ **Replies:** 4\ **Last updated:** [September 19, 2020, 9:08pm UTC](https://discuss.elastic.co/t/get-data-from-elasticsearch-and-visualize-it-using-python/249221 "2020-09-19T21:08:49Z")
Hi, currently, I have to develop a data analytics dashboard on a web platform. It is possible if I load my datasets to elasticsearch using logstash without using kibana for the visualisation? Because I prefer to use pyth… --- ## [Bar chart percentage mode?](https://discuss.elastic.co/t/bar-chart-percentage-mode/249214)
**Author:** [@NiclasK](https://discuss.elastic.co/u/NiclasK)\ **Replies:** 1\ **Last updated:** [September 19, 2020, 8:54pm UTC](https://discuss.elastic.co/t/bar-chart-percentage-mode/249214 "2020-09-19T20:54:10Z")
Is there a percentage mode for stacked bar charts in Kibana 7.9.1? I've seen some references to it, but I can't find it... --- ## [How to remove\_field for json data by http\_poller at all once](https://discuss.elastic.co/t/how-to-remove-field-for-json-data-by-http-poller-at-all-once/248545)
**Author:** [@unisuke](https://discuss.elastic.co/u/unisuke)\ **Replies:** 1\ **Last updated:** [September 19, 2020, 2:47pm UTC](https://discuss.elastic.co/t/how-to-remove-field-for-json-data-by-http-poller-at-all-once/248545 "2020-09-19T14:47:38Z")
Hi. I want to filter for jason getting by http\_poller plugin. For example, it's below. "content" =\> \[ \[0\] { "AList" =\> \[ \[0\] { "name" =\> "X", }, \[1\] { "name" =\> "Y, } … --- ## [Best web cache](https://discuss.elastic.co/t/best-web-cache/249206)
**Author:** [@highlandspring](https://discuss.elastic.co/u/highlandspring)\ **Replies:** 4\ **Last updated:** [September 19, 2020, 9:06am UTC](https://discuss.elastic.co/t/best-web-cache/249206 "2020-09-19T09:06:09Z")
I am working on a Business Intelligence projects, it has a large number of records, 4.6 million companies and 80 million directors. Currently I am replacing the full text queries with Elastic Search ones. Once this is … --- ## [Can logstash add array field to elasticsearch?](https://discuss.elastic.co/t/can-logstash-add-array-field-to-elasticsearch/249202)
**Author:** [@recordable542](https://discuss.elastic.co/u/recordable542)\ **Replies:** 0\ **Last updated:** [September 19, 2020, 7:09am UTC](https://discuss.elastic.co/t/can-logstash-add-array-field-to-elasticsearch/249202 "2020-09-19T07:09:58Z")
My Environment mysql logstash (with jdbc plugin) 7.8.0 elasticsearch 7.6.2 pipeline.yaml ... statement =\> "SELECT id, name, location1, location2 FROM users;" ... I have location1 and location2 column in mysql users ta… --- ## [S3 input plugin is not reading AWS-KMS (CMK) encrypted bucket](https://discuss.elastic.co/t/s3-input-plugin-is-not-reading-aws-kms-cmk-encrypted-bucket/249199)
**Author:** [@deepanshumarwah](https://discuss.elastic.co/u/deepanshumarwah)\ **Replies:** 0\ **Last updated:** [September 19, 2020, 6:38am UTC](https://discuss.elastic.co/t/s3-input-plugin-is-not-reading-aws-kms-cmk-encrypted-bucket/249199 "2020-09-19T06:38:18Z")
Hi All I am running a logstash container with s3 pipeline as per below configuration: input { s3 { id =\> "pipeline\_s3\_example\_bucket\_input" bucket =\> "example-bucket" region =\> "ap-southeast-1" access… --- ## [What is better. Monthly Indices or 1 Index with more shards?](https://discuss.elastic.co/t/what-is-better-monthly-indices-or-1-index-with-more-shards/248982)
**Author:** [@defalt](https://discuss.elastic.co/u/defalt)\ **Replies:** 4\ **Last updated:** [September 19, 2020, 6:09am UTC](https://discuss.elastic.co/t/what-is-better-monthly-indices-or-1-index-with-more-shards/248982 "2020-09-19T06:09:07Z")
Hi, we are currently planning a cluster which takes about 1TB/year worth of data. When using a standard shard size of 5 this would mean that the shards are 250GB. As far as I know shards should only be around 50-70GB at… --- ## [How to authenticate to elastic search from java](https://discuss.elastic.co/t/how-to-authenticate-to-elastic-search-from-java/249165)
**Author:** [@guruthejus](https://discuss.elastic.co/u/guruthejus)\ **Replies:** 2\ **Last updated:** [September 19, 2020, 5:06am UTC](https://discuss.elastic.co/t/how-to-authenticate-to-elastic-search-from-java/249165 "2020-09-19T05:06:59Z")
Hi, I am trying to authenticate to ES in java. But getting malformed host header exception. Someone please help here. final CredentialsProvider credentialsProvider = new BasicCredential… --- ## [Index and query at the same time speed loss](https://discuss.elastic.co/t/index-and-query-at-the-same-time-speed-loss/249191)
**Author:** [@Sayon\_Bhattacharjee](https://discuss.elastic.co/u/Sayon_Bhattacharjee)\ **Replies:** 1\ **Last updated:** [September 19, 2020, 3:22am UTC](https://discuss.elastic.co/t/index-and-query-at-the-same-time-speed-loss/249191 "2020-09-19T03:22:15Z")
I currently have an Elasticsearch index which is receiving 1 document/second (possible that will increase but not over 10/second). However, this index may get queried hundreds of times a second. My question is whether c… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1795) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1797)