# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1803 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1804 --- ## [Elastic to many open files](https://discuss.elastic.co/t/elastic-to-many-open-files/247616)
**Author:** [@akshay\_dindure1994](https://discuss.elastic.co/u/akshay_dindure1994)\ **Replies:** 5\ **Last updated:** [September 10, 2020, 4:27pm UTC](https://discuss.elastic.co/t/elastic-to-many-open-files/247616 "2020-09-10T16:27:07Z")
Hello Team I am facing some serious problems in elastic. I am getting below error in elastic logs /opt/SOME\_DIRECTORY\_NAME/elasticsearch/data/nodes/0/indices/7QRpS9mnSwCHPdBwaLUJag/3/translog/translog-53.ckp: Too many … --- ## [Queries on "ip\_range" type (missing documentation)](https://discuss.elastic.co/t/queries-on-ip-range-type-missing-documentation/246445)
**Author:** [@YvorL](https://discuss.elastic.co/u/YvorL)\ **Replies:** 7\ **Last updated:** [September 16, 2020, 10:47am UTC](https://discuss.elastic.co/t/queries-on-ip-range-type-missing-documentation/246445 "2020-09-16T10:47:23Z")
Hi, Unfortunately, I couldn't find any pointers in the documentation. I'd like to have some IP ranges saved and be able to: Perform a query for an IP address. Perform a query for a CIDR range. I got #1 working with q… --- ## [Move warm phase indices to a new warm node](https://discuss.elastic.co/t/move-warm-phase-indices-to-a-new-warm-node/248728)
**Author:** [@liorg2](https://discuss.elastic.co/u/liorg2)\ **Replies:** 4\ **Last updated:** [September 16, 2020, 10:43am UTC](https://discuss.elastic.co/t/move-warm-phase-indices-to-a-new-warm-node/248728 "2020-09-16T10:43:32Z")
Hello, Is there a way to move indices that have passed the warm phase to a warm node? none was selected in the ILM screen, and currently they are all on the 'hot node" I selected the correct node in the ILM page, but … --- ## [Kubernetes pods are not ready in a Cluster with xpack.security.enabled: true after the pod restart](https://discuss.elastic.co/t/kubernetes-pods-are-not-ready-in-a-cluster-with-xpack-security-enabled-true-after-the-pod-restart/248010)
**Author:** [@ratnakar](https://discuss.elastic.co/u/ratnakar)\ **Replies:** 3\ **Last updated:** [September 16, 2020, 10:38am UTC](https://discuss.elastic.co/t/kubernetes-pods-are-not-ready-in-a-cluster-with-xpack-security-enabled-true-after-the-pod-restart/248010 "2020-09-16T10:38:16Z")
I have created an elasticsearch in Kubernetes using helm charts(helm version 3) by enabling xpack.security. It was working fine and did not find any issues. Today I have deleted those pods and after that Pods are not onl… --- ## [How to convert bytes in MB/GB data in Metribeat system module](https://discuss.elastic.co/t/how-to-convert-bytes-in-mb-gb-data-in-metribeat-system-module/248755)
**Author:** [@Ekta](https://discuss.elastic.co/u/Ekta)\ **Replies:** 2\ **Last updated:** [September 16, 2020, 10:29am UTC](https://discuss.elastic.co/t/how-to-convert-bytes-in-mb-gb-data-in-metribeat-system-module/248755 "2020-09-16T10:29:06Z")
I enable the system module but the data come into the format of the byte. Can anyone helps how to convert it or any config need to change in metricbeat? --- ## [How to fetch only Public or Private IP in ES?](https://discuss.elastic.co/t/how-to-fetch-only-public-or-private-ip-in-es/248717)
**Author:** [@Ramesh\_balasubramani](https://discuss.elastic.co/u/Ramesh_balasubramani)\ **Replies:** 3\ **Last updated:** [September 16, 2020, 9:53am UTC](https://discuss.elastic.co/t/how-to-fetch-only-public-or-private-ip-in-es/248717 "2020-09-16T09:53:15Z")
GET logstash-ramesh-2020.09.16/\_search { "query": { "bool": { "must\_not": \[ { "regexp": { "src\_ip.raw": { "value": "^(?:10|127|172\\\\.(?:1\[6-9\]|2\[0-9\]|3\[… --- ## [Filebeat fails to parse GuardDuty json logs](https://discuss.elastic.co/t/filebeat-fails-to-parse-guardduty-json-logs/248696)
**Author:** [@Ameer\_Mukadam](https://discuss.elastic.co/u/Ameer_Mukadam)\ **Replies:** 5\ **Last updated:** [September 16, 2020, 10:25am UTC](https://discuss.elastic.co/t/filebeat-fails-to-parse-guardduty-json-logs/248696 "2020-09-16T10:25:25Z")
So I am trying to ingest Guarduty logs from S3 to elasticsearch using filebeats s3 input. The logs are getting indexed but they are not getting parsed, everything goes under message field and all the logs are in json for… --- ## [ElasticSearch Keyword usage with a prefix search](https://discuss.elastic.co/t/elasticsearch-keyword-usage-with-a-prefix-search/248695)
**Author:** [@Sunilbvr](https://discuss.elastic.co/u/Sunilbvr)\ **Replies:** 2\ **Last updated:** [September 16, 2020, 10:23am UTC](https://discuss.elastic.co/t/elasticsearch-keyword-usage-with-a-prefix-search/248695 "2020-09-16T10:23:30Z")
I have a requirement to be able to search a sentence as complete or with prefix. The UI library (reactive search) I am using is generating the query in this way: "simple\_query\_string": { "query": "\\"Louis George Mauri… --- ## [Using context in trigger interval](https://discuss.elastic.co/t/using-context-in-trigger-interval/247495)
**Author:** [@Mark\_Veenstra](https://discuss.elastic.co/u/Mark_Veenstra)\ **Replies:** 1\ **Last updated:** [September 16, 2020, 10:07am UTC](https://discuss.elastic.co/t/using-context-in-trigger-interval/247495 "2020-09-16T10:07:20Z")
When I try to do the next: { "trigger": { "schedule": { "interval": "{{ctx.metadata.config.interval}}s" } } "metadata": { "interval": 5 } } It will not work and throws the error: \[parse\_except… --- ## [Watcher actions body](https://discuss.elastic.co/t/watcher-actions-body/247943)
**Author:** [@hero](https://discuss.elastic.co/u/hero)\ **Replies:** 1\ **Last updated:** [September 16, 2020, 10:01am UTC](https://discuss.elastic.co/t/watcher-actions-body/247943 "2020-09-16T10:01:38Z")
Watcher actions body How to save search query watcher configure: { "trigger": { "schedule": { "interval": "10s" } }, "input": { "search": { "request": { "search\_type": "query\_the… --- ## [Use painless variable across watch segments](https://discuss.elastic.co/t/use-painless-variable-across-watch-segments/247715)
**Author:** [@lstoneir](https://discuss.elastic.co/u/lstoneir)\ **Replies:** 1\ **Last updated:** [September 16, 2020, 9:57am UTC](https://discuss.elastic.co/t/use-painless-variable-across-watch-segments/247715 "2020-09-16T09:57:55Z")
i want to set name\_of\_server in condition area and use it inside logging action. is this possible? "actions": { "my-logging-action": { "condition":{ "script": { "source": " … --- ## [reason:'None' is not an IP string literal](https://discuss.elastic.co/t/reason-none-is-not-an-ip-string-literal/248753)
**Author:** [@wajika](https://discuss.elastic.co/u/wajika)\ **Replies:** 2\ **Last updated:** [September 16, 2020, 9:57am UTC](https://discuss.elastic.co/t/reason-none-is-not-an-ip-string-literal/248753 "2020-09-16T09:57:27Z")
2020-09-16T01:04:38.158Z INFO instance/beat.go:640 Home path: \[/usr/share/metricbeat\] Config path: \[/usr/share/metricbeat\] Data path: \[/usr/share/metricbeat/data\] Logs path: \[/usr/share/metricbeat/logs\] 2020-09-16T01:0… --- ## [Watcher alerts not working as expected](https://discuss.elastic.co/t/watcher-alerts-not-working-as-expected/248593)
**Author:** [@kiwibel](https://discuss.elastic.co/u/kiwibel)\ **Replies:** 1\ **Last updated:** [September 16, 2020, 9:56am UTC](https://discuss.elastic.co/t/watcher-alerts-not-working-as-expected/248593 "2020-09-16T09:56:14Z")
Hi all, We use ES v7.9.0 in Elastic Cloud. Each cluster forwards monitoring data to the dedicated monitoring deployment. We've added a few watches to alert on cluster health issues e.g. cluster status not green, heap … --- ## [Filebeat Autodiscover Configuration](https://discuss.elastic.co/t/filebeat-autodiscover-configuration/248740)
**Author:** [@Paul\_B](https://discuss.elastic.co/u/Paul_B)\ **Replies:** 2\ **Last updated:** [September 16, 2020, 9:51am UTC](https://discuss.elastic.co/t/filebeat-autodiscover-configuration/248740 "2020-09-16T09:51:13Z")
Can anyone shed some light on where exactly in the YAML config the configuration property "cleanup\_timeout" is supposed to sit? We're using Filebeat Autodiscover for Kubernetes and unfortunately the documentation around… --- ## [Overwrite metricbeat time period](https://discuss.elastic.co/t/overwrite-metricbeat-time-period/248809)
**Author:** [@sandeep1-0](https://discuss.elastic.co/u/sandeep1-0)\ **Replies:** 0\ **Last updated:** [September 16, 2020, 9:49am UTC](https://discuss.elastic.co/t/overwrite-metricbeat-time-period/248809 "2020-09-16T09:49:51Z")
Hi I have new module which collect url health. I need to overwrite the default time period with multiple values which is taken through user input. For first url let say time interval is 30 seconds and second url 60 secon… --- ## [Watcher multiple query with \< and \> in match](https://discuss.elastic.co/t/watcher-multiple-query-with-and-in-match/248691)
**Author:** [@suryanaj](https://discuss.elastic.co/u/suryanaj)\ **Replies:** 2\ **Last updated:** [September 16, 2020, 9:46am UTC](https://discuss.elastic.co/t/watcher-multiple-query-with-and-in-match/248691 "2020-09-16T09:46:10Z")
i am not getting any output and getting number match exception in output in 2nd query. Please suggest. i want to use match like { "match": { "http.response.status\_code": "\<500 && \>599" } }, … --- ## [Logstash not pushing logs to kafka after it started](https://discuss.elastic.co/t/logstash-not-pushing-logs-to-kafka-after-it-started/248804)
**Author:** [@hariumesh](https://discuss.elastic.co/u/hariumesh)\ **Replies:** 0\ **Last updated:** [September 16, 2020, 9:29am UTC](https://discuss.elastic.co/t/logstash-not-pushing-logs-to-kafka-after-it-started/248804 "2020-09-16T09:29:37Z")
Hi All, I am new to logstash and iam trying to building a pipeline to push logs from a logdirectory to the kafka topic so i have below config file input { file { path =\> "/home/ubuntu/log\_dir/log\_json.json" … --- ## [2.x change to 6.x agg bug or not，what can i do？](https://discuss.elastic.co/t/2-x-change-to-6-x-agg-bug-or-not-what-can-i-do/248793)
**Author:** [@CSuperC](https://discuss.elastic.co/u/CSuperC)\ **Replies:** 2\ **Last updated:** [September 16, 2020, 9:28am UTC](https://discuss.elastic.co/t/2-x-change-to-6-x-agg-bug-or-not-what-can-i-do/248793 "2020-09-16T09:28:53Z")
our 2.x agg very good，bug agg 6.x is worst one day 3kw logs，then agg logs by a,b,c,d, very well in 2.x，when use in 6.x ，server is bad ，out of memery 2.x and 6.x java heap is almost the same ，6.x is more heap one day i… --- ## [Write error: failed to rotate backups: failed to rotate backups](https://discuss.elastic.co/t/write-error-failed-to-rotate-backups-failed-to-rotate-backups/248778)
**Author:** [@Shriram\_Wasule](https://discuss.elastic.co/u/Shriram_Wasule)\ **Replies:** 0\ **Last updated:** [September 16, 2020, 7:06am UTC](https://discuss.elastic.co/t/write-error-failed-to-rotate-backups-failed-to-rotate-backups/248778 "2020-09-16T07:06:53Z")
I am trying to start metricbeat from powershell ut after running i am getting above error. Also i am not able to receive any data in kibana. i can just see disk usage. rest visualization is not visible to me. even i tr… --- ## [Filebeat Cisco FTD](https://discuss.elastic.co/t/filebeat-cisco-ftd/248797)
**Author:** [@Shadowphax](https://discuss.elastic.co/u/Shadowphax)\ **Replies:** 0\ **Last updated:** [September 16, 2020, 9:08am UTC](https://discuss.elastic.co/t/filebeat-cisco-ftd/248797 "2020-09-16T09:08:45Z")
Hi All, I have Cisco FTD enabled and it is ingesting lots of data into ES. Great. However, after looking at the various data in ES I noticed a few entries missing which I see in the syslog on the default port 9003 using… --- ## [Not able to configure Alerts in Kibana](https://discuss.elastic.co/t/not-able-to-configure-alerts-in-kibana/248765)
**Author:** [@pankaj0172](https://discuss.elastic.co/u/pankaj0172)\ **Replies:** 10\ **Last updated:** [September 16, 2020, 9:04am UTC](https://discuss.elastic.co/t/not-able-to-configure-alerts-in-kibana/248765 "2020-09-16T09:04:44Z")
Hi, Can someone please help me to enable Alerts and Action option in Kibana as showing Additional setup required, I tried few settings but didn't work. If anyone can provide me the configuration which needs to be chang… --- ## [Import a csv, ndjson or log file not showing in Kibana](https://discuss.elastic.co/t/import-a-csv-ndjson-or-log-file-not-showing-in-kibana/248511)
**Author:** [@Maria20](https://discuss.elastic.co/u/Maria20)\ **Replies:** 7\ **Last updated:** [September 16, 2020, 9:01am UTC](https://discuss.elastic.co/t/import-a-csv-ndjson-or-log-file-not-showing-in-kibana/248511 "2020-09-16T09:01:25Z")
Hello, I am using Kibana 7.3.2 and Elastic 7.3.2 to visualize some data but I cannot see the option to "import a csv ndjson or log file" Thank you, --- ## [Offline plugin install logstash-filter-date\_formatter on logstash 7.4.2](https://discuss.elastic.co/t/offline-plugin-install-logstash-filter-date-formatter-on-logstash-7-4-2/248514)
**Author:** [@goncalobsantos](https://discuss.elastic.co/u/goncalobsantos)\ **Replies:** 2\ **Last updated:** [September 16, 2020, 8:28am UTC](https://discuss.elastic.co/t/offline-plugin-install-logstash-filter-date-formatter-on-logstash-7-4-2/248514 "2020-09-16T08:28:33Z")
I downloaded the zip file with the plugin from Github: https://github.com/wiibaa/logstash-filter-date\_formatter I followed the documentation here, and tried installing the plugin by running the command: ./logstash-plug… --- ## [Adding credentials to helm chart](https://discuss.elastic.co/t/adding-credentials-to-helm-chart/242420)
**Author:** [@joshuacox](https://discuss.elastic.co/u/joshuacox)\ **Replies:** 6\ **Last updated:** [September 16, 2020, 8:11am UTC](https://discuss.elastic.co/t/adding-credentials-to-helm-chart/242420 "2020-09-16T08:11:00Z")
On this page the section on adding a snapshot says: Add any required secrets or credentials into an Elasticsearch keystore following the how to use the keystore guide. But I am confused as to what to name the secret? … --- ## [Kibana Alerting won't create specified index](https://discuss.elastic.co/t/kibana-alerting-wont-create-specified-index/242738)
**Author:** [@knrdv](https://discuss.elastic.co/u/knrdv)\ **Replies:** 9\ **Last updated:** [September 16, 2020, 7:57am UTC](https://discuss.elastic.co/t/kibana-alerting-wont-create-specified-index/242738 "2020-09-16T07:57:46Z")
Hi, my problem is that when I set-up alerting using index alerting connector, no index gets created when alerts trigger. Could someone please help and write down the steps needed to set-up Kibana alerting to write to a s… --- ## [How to pick range of splitted field in mutate filter](https://discuss.elastic.co/t/how-to-pick-range-of-splitted-field-in-mutate-filter/248656)
**Author:** [@dorinand](https://discuss.elastic.co/u/dorinand)\ **Replies:** 2\ **Last updated:** [September 16, 2020, 7:44am UTC](https://discuss.elastic.co/t/how-to-pick-range-of-splitted-field-in-mutate-filter/248656 "2020-09-16T07:44:43Z")
I generate field on input: input { generator { add\_field =\> { "\[kubernetes\]\[pod\]\[name\]" =\> "aaaa-bbbb-a1b2c3" } count =\> 1 } } I need to remove last part of pod name a1b2c3. Iam trying to split it… --- ## [How to give read only privileges in the Index management module?](https://discuss.elastic.co/t/how-to-give-read-only-privileges-in-the-index-management-module/247155)
**Author:** [@AClerk](https://discuss.elastic.co/u/AClerk)\ **Replies:** 6\ **Last updated:** [September 16, 2020, 7:05am UTC](https://discuss.elastic.co/t/how-to-give-read-only-privileges-in-the-index-management-module/247155 "2020-09-16T07:05:05Z")
Hello, How can I give read-only permissions to the "Index Management" module? So users can search for indices, but not delete, freeze, flush, etc. The use case is, that I want to give users permission to create index … --- ## [How to do Hive-logstash integration?](https://discuss.elastic.co/t/how-to-do-hive-logstash-integration/248776)
**Author:** [@Rahul\_Chougule](https://discuss.elastic.co/u/Rahul_Chougule)\ **Replies:** 0\ **Last updated:** [September 16, 2020, 6:58am UTC](https://discuss.elastic.co/t/how-to-do-hive-logstash-integration/248776 "2020-09-16T06:58:22Z")
I want to connect hive through Logstash to ingest data in Elasticsearch. What is the correct configuration to achieve the connection? --- ## [How to disable http in elasticsearch](https://discuss.elastic.co/t/how-to-disable-http-in-elasticsearch/248359)
**Author:** [@knagasri](https://discuss.elastic.co/u/knagasri)\ **Replies:** 14\ **Last updated:** [September 16, 2020, 6:14am UTC](https://discuss.elastic.co/t/how-to-disable-http-in-elasticsearch/248359 "2020-09-16T06:14:40Z")
How to disable http on data or master nodes , how to specify in cr file. Please anyone help me out. --- ## [Problem with elasticsearch service](https://discuss.elastic.co/t/problem-with-elasticsearch-service/248482)
**Author:** [@Weathmious](https://discuss.elastic.co/u/Weathmious)\ **Replies:** 7\ **Last updated:** [September 16, 2020, 6:09am UTC](https://discuss.elastic.co/t/problem-with-elasticsearch-service/248482 "2020-09-16T06:09:34Z")
Hello, I know there have been topics on this before, but none of them have helped me solve my problem. The drive of my graylog server (on centOS) was filling up way too fast, and I wanted to put elasticsearch on a separ… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1802) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1804)