# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1809 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1810 --- ## [Refresh interval on indices with no changes](https://discuss.elastic.co/t/refresh-interval-on-indices-with-no-changes/248368)
**Author:** [@Silas\_Hansen](https://discuss.elastic.co/u/Silas_Hansen)\ **Replies:** 2\ **Last updated:** [September 14, 2020, 10:29am UTC](https://discuss.elastic.co/t/refresh-interval-on-indices-with-no-changes/248368 "2020-09-14T10:29:16Z")
If I explicitly set a refresh\_interval on an index, will it still run the refresh operation, even if no new documents have been indexed to it since the last refresh? I'm trying to understand if setting an explicit refre… --- ## [Elasticsearch Docker: flood stage disk watermark \[95%\] exceeded](https://discuss.elastic.co/t/elasticsearch-docker-flood-stage-disk-watermark-95-exceeded/248479)
**Author:** [@Stimmot](https://discuss.elastic.co/u/Stimmot)\ **Replies:** 3\ **Last updated:** [September 14, 2020, 9:53am UTC](https://discuss.elastic.co/t/elasticsearch-docker-flood-stage-disk-watermark-95-exceeded/248479 "2020-09-14T09:53:30Z")
I have a problem with my Elasticsearch nodes running in a docker environment. I'm starting them up with docker-compose and after a few minutes they tell me: flood stage disk watermark \[95%\] exceeded I'm running it on a… --- ## [Kibana 7.9.1: Startup Issue](https://discuss.elastic.co/t/kibana-7-9-1-startup-issue/248486)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 1\ **Last updated:** [September 14, 2020, 9:33am UTC](https://discuss.elastic.co/t/kibana-7-9-1-startup-issue/248486 "2020-09-14T09:33:50Z")
Hi, We're setting up a new 7.9.1 elasticsearch/kibana combo. where kibana is running in kubernetes. This is a normal topology for us. However, I'm seeing errors that don't make sense in the kibana log: {"type":"log","… --- ## [Logstash influxdb output with geoip feature](https://discuss.elastic.co/t/logstash-influxdb-output-with-geoip-feature/247763)
**Author:** [@Vladpov](https://discuss.elastic.co/u/Vladpov)\ **Replies:** 6\ **Last updated:** [September 14, 2020, 9:16am UTC](https://discuss.elastic.co/t/logstash-influxdb-output-with-geoip-feature/247763 "2020-09-14T09:16:46Z")
I'm trying to use logstash geoip filter to send data about location of IP address to InfluxDB via InfluxDB output plugin. My logstash conf file is: input { file { path =\> "/root/geoip\_test.txt" start\_position… --- ## [Logstash GROK](https://discuss.elastic.co/t/logstash-grok/248485)
**Author:** [@Jokie74](https://discuss.elastic.co/u/Jokie74)\ **Replies:** 4\ **Last updated:** [September 14, 2020, 9:08am UTC](https://discuss.elastic.co/t/logstash-grok/248485 "2020-09-14T09:08:42Z")
Hello Community, I'm a bit lost with creating a grok filter and need some help... I am using filebeat for AIX to send errpt messages with syslog to logstash and Kibana to visualize... The Log coming from AIX error\_dea… --- ## [Another Kibana instance appears to be migrating the index - Docker environment](https://discuss.elastic.co/t/another-kibana-instance-appears-to-be-migrating-the-index-docker-environment/248487)
**Author:** [@Stimmot](https://discuss.elastic.co/u/Stimmot)\ **Replies:** 1\ **Last updated:** [September 14, 2020, 8:59am UTC](https://discuss.elastic.co/t/another-kibana-instance-appears-to-be-migrating-the-index-docker-environment/248487 "2020-09-14T08:59:08Z")
I have three Elasticsearch nodes running with docker-compose. When I start the additional kibana service, it gets stuck on: Another Kibana instance appears to be migrating the index. Waiting for that migration to comple… --- ## [Iso 8601 time duration support](https://discuss.elastic.co/t/iso-8601-time-duration-support/248410)
**Author:** [@bnarang](https://discuss.elastic.co/u/bnarang)\ **Replies:** 5\ **Last updated:** [September 14, 2020, 8:44am UTC](https://discuss.elastic.co/t/iso-8601-time-duration-support/248410 "2020-09-14T08:44:36Z")
Does elasticsearch supports iso time duration P\[n\]Y\[n\]M\[n\]DT\[n\]H\[n\]M\[n\]S? I would be receiving data in this format, want to index in the same format and would like the range operation available on that. --- ## [Winlogbeat filtering problem](https://discuss.elastic.co/t/winlogbeat-filtering-problem/248297)
**Author:** [@jpeyton](https://discuss.elastic.co/u/jpeyton)\ **Replies:** 2\ **Last updated:** [September 14, 2020, 8:30am UTC](https://discuss.elastic.co/t/winlogbeat-filtering-problem/248297 "2020-09-14T08:30:20Z")
Hi, What I want to do achieve is to send all events from the Security log except event id 4672 and 4627. This works well, but what I can't find out how to do, is make a rule that send event id 4627 only if it does not h… --- ## [When getting a CompletedReindexResponse, I'm receiving an interesting message: Invalid NEST response built from a null ApiCall which is highly exceptional, please open a bug if you see this](https://discuss.elastic.co/t/when-getting-a-completedreindexresponse-im-receiving-an-interesting-message-invalid-nest-response-built-from-a-null-apicall-which-is-highly-exceptional-please-open-a-bug-if-you-see-this/248164)
**Author:** [@CollabcoAndy](https://discuss.elastic.co/u/CollabcoAndy)\ **Replies:** 7\ **Last updated:** [September 14, 2020, 7:59am UTC](https://discuss.elastic.co/t/when-getting-a-completedreindexresponse-im-receiving-an-interesting-message-invalid-nest-response-built-from-a-null-apicall-which-is-highly-exceptional-please-open-a-bug-if-you-see-this/248164 "2020-09-14T07:59:22Z")
Hi all, I'm exploring the NEST client currently and followed the code for ReindexOnServer here: https://www.elastic.co/guide/en/elasticsearch/client/net-api/current/reindexing-documents.html I have followed the code p… --- ## [How to get total term frequency through aggregation in elastic](https://discuss.elastic.co/t/how-to-get-total-term-frequency-through-aggregation-in-elastic/248483)
**Author:** [@Ubeta](https://discuss.elastic.co/u/Ubeta)\ **Replies:** 0\ **Last updated:** [September 14, 2020, 7:57am UTC](https://discuss.elastic.co/t/how-to-get-total-term-frequency-through-aggregation-in-elastic/248483 "2020-09-14T07:57:45Z")
Hi! In a search result, I want to get the total number of times a term has showed in the list of documents returned. By only using term aggregations, I can only get the doc count but what I want is the total number of t… --- ## [Grok filter not parsing path](https://discuss.elastic.co/t/grok-filter-not-parsing-path/248331)
**Author:** [@Renato](https://discuss.elastic.co/u/Renato)\ **Replies:** 2\ **Last updated:** [September 14, 2020, 7:39am UTC](https://discuss.elastic.co/t/grok-filter-not-parsing-path/248331 "2020-09-14T07:39:29Z")
Hello, i would like to retrieve only the name of my log file, but my grok filter doesn't work. When i put it in grok debugger it works without any problems, also logstash doesn't report any error, i just get tag grokpar… --- ## [Pod goes to crashloopbackoff](https://discuss.elastic.co/t/pod-goes-to-crashloopbackoff/248476)
**Author:** [@knagasri](https://discuss.elastic.co/u/knagasri)\ **Replies:** 0\ **Last updated:** [September 14, 2020, 7:26am UTC](https://discuss.elastic.co/t/pod-goes-to-crashloopbackoff/248476 "2020-09-14T07:26:29Z")
When I deployed Elasticsearch in GCP, It works fine , Suddenly one of my ingest pod goes to crashLoop Backoff, remaining all pods are running fine. I am running with 4 ingest nodes and 3 master nodes. Operator version … --- ## [Scale to Y-Axis Data Bounds not working in Kibana 7.8.1 Visualization](https://discuss.elastic.co/t/scale-to-y-axis-data-bounds-not-working-in-kibana-7-8-1-visualization/246305)
**Author:** [@Gil\_Levi](https://discuss.elastic.co/u/Gil_Levi)\ **Replies:** 9\ **Last updated:** [September 14, 2020, 6:54am UTC](https://discuss.elastic.co/t/scale-to-y-axis-data-bounds-not-working-in-kibana-7-8-1-visualization/246305 "2020-09-14T06:54:32Z")
Hi I'm trying to create a split Line chart and, where Y-axis has different rangest the "Scale to Data Bounds" under Y-Axis settings is turned on but it seemed like it's not working --- ## [Metricbeat tar vs rpm](https://discuss.elastic.co/t/metricbeat-tar-vs-rpm/248468)
**Author:** [@karthikeyanajendran1](https://discuss.elastic.co/u/karthikeyanajendran1)\ **Replies:** 4\ **Last updated:** [September 14, 2020, 5:06am UTC](https://discuss.elastic.co/t/metricbeat-tar-vs-rpm/248468 "2020-09-14T05:06:02Z")
Hi Experts, We are using metricbeat in our project to capture and monitor host and oracle modules statistics. We have plan to have automation script which download the metricbeat package , setup the metricbeat configur… --- ## [Failed to execute action {:id=\>:main, :action\_type=\>LogStash::ConvergeResult::FailedAction,](https://discuss.elastic.co/t/failed-to-execute-action-id-main-action-type-logstash-failedaction/248284)
**Author:** [@AkatsukiPain](https://discuss.elastic.co/u/AkatsukiPain)\ **Replies:** 2\ **Last updated:** [September 14, 2020, 2:23am UTC](https://discuss.elastic.co/t/failed-to-execute-action-id-main-action-type-logstash-failedaction/248284 "2020-09-14T02:23:56Z")
I run logstash with these config, and there is error when running (Fresh install with kibana or elasticsearch): Could u guys help me check this issue? I have tried to find out the problem in some topics but not work … --- ## [Does not whiteliist\_names support \[field\]\[subfiled\] logstash?](https://discuss.elastic.co/t/does-not-whiteliist-names-support-field-subfiled-logstash/248430)
**Author:** [@unisuke](https://discuss.elastic.co/u/unisuke)\ **Replies:** 2\ **Last updated:** [September 14, 2020, 2:13am UTC](https://discuss.elastic.co/t/does-not-whiteliist-names-support-field-subfiled-logstash/248430 "2020-09-14T02:13:10Z")
Hi, Does filter/whtielist\_names support \[fiield\]\[subfield\]? filter { prune { whitelist\_names =\> \["\[content\]\[0\]"\] } } I'm tring above filter for below. When no filter does, the result i… --- ## [Elastic Cloud Cross Cluster Replication](https://discuss.elastic.co/t/elastic-cloud-cross-cluster-replication/248464)
**Author:** [@Aaron\_Chen](https://discuss.elastic.co/u/Aaron_Chen)\ **Replies:** 0\ **Last updated:** [September 14, 2020, 1:20am UTC](https://discuss.elastic.co/t/elastic-cloud-cross-cluster-replication/248464 "2020-09-14T01:20:00Z")
As far as I concerned, Elastic is providing cross-cluster replication whereby user can have a secondary cluster serving as a hot backup -- https://www.elastic.co/guide/en/elasticsearch/reference/current/xpack-ccr.html H… --- ## [Kibana website is not working](https://discuss.elastic.co/t/kibana-website-is-not-working/248277)
**Author:** [@muthug](https://discuss.elastic.co/u/muthug)\ **Replies:** 1\ **Last updated:** [September 13, 2020, 11:30pm UTC](https://discuss.elastic.co/t/kibana-website-is-not-working/248277 "2020-09-13T23:30:16Z")
Till yesterday everything was working fine, from today both node is not working. Node 1: root@sys1 init.d# curl -XGET localhost:9200/\_cluster/health?pretty { "cluster\_name" : "BPElasticSearch", "status" : "red", "t… --- ## [Unable to start elasticsearch 7.8 container with a password](https://discuss.elastic.co/t/unable-to-start-elasticsearch-7-8-container-with-a-password/248304)
**Author:** [@Ayush\_Agrahari](https://discuss.elastic.co/u/Ayush_Agrahari)\ **Replies:** 1\ **Last updated:** [September 13, 2020, 11:29pm UTC](https://discuss.elastic.co/t/unable-to-start-elasticsearch-7-8-container-with-a-password/248304 "2020-09-13T23:29:37Z")
Hello, I am attempting to setup an elastisearch cluster using a hot and warm bode using one docker-compose. However, when starting up the setup I am unable to log in, and see the following error in docker logs: "stackt… --- ## [Filebeat upload log to es5 , 403](https://discuss.elastic.co/t/filebeat-upload-log-to-es5-403/248266)
**Author:** [@Adonis\_Zzq](https://discuss.elastic.co/u/Adonis_Zzq)\ **Replies:** 9\ **Last updated:** [September 13, 2020, 11:24pm UTC](https://discuss.elastic.co/t/filebeat-upload-log-to-es5-403/248266 "2020-09-13T23:24:29Z")
I use es 5.6.4 , filebeat upload log to es, return 403 ,What could cause this? The log is as follows: 2020-09-11T14:14:25+08:00 ERR Failed to perform any bulk index operations: 403 Forbidden 2020-09-11T14:14:25+08:00 … --- ## [Is HTTP on each node will enable by default](https://discuss.elastic.co/t/is-http-on-each-node-will-enable-by-default/248325)
**Author:** [@chandu2](https://discuss.elastic.co/u/chandu2)\ **Replies:** 3\ **Last updated:** [September 13, 2020, 11:21pm UTC](https://discuss.elastic.co/t/is-http-on-each-node-will-enable-by-default/248325 "2020-09-13T23:21:42Z")
Will HTTP enable by default. If enabled by default. How can we disable it. Anyone help me out this. To disable, Can I use http.enabled : false --- ## [Access elasticsearch from outside network \< my static public ip address \>:9200](https://discuss.elastic.co/t/access-elasticsearch-from-outside-network-my-static-public-ip-address-9200/248340)
**Author:** [@Abdul\_Samad](https://discuss.elastic.co/u/Abdul_Samad)\ **Replies:** 2\ **Last updated:** [September 13, 2020, 11:19pm UTC](https://discuss.elastic.co/t/access-elasticsearch-from-outside-network-my-static-public-ip-address-9200/248340 "2020-09-13T23:19:01Z")
I have my Elasticsearch running on my windows 10 server. I want to access it with \< my static public ip address \>:9200 I can access it with: localhost:9200 127.0.0.1:9200 \< my ipv4 address from ipconfig \>:9200 But i … --- ## [Logstash always creates elasticsearch indexes if they dont exist](https://discuss.elastic.co/t/logstash-always-creates-elasticsearch-indexes-if-they-dont-exist/248444)
**Author:** [@ejhayes](https://discuss.elastic.co/u/ejhayes)\ **Replies:** 3\ **Last updated:** [September 13, 2020, 11:16pm UTC](https://discuss.elastic.co/t/logstash-always-creates-elasticsearch-indexes-if-they-dont-exist/248444 "2020-09-13T23:16:30Z")
I precreated Elasticsearch indexes with alias "logstash-beats" and "logstash-postgres" and that works fine with Logstash output. However I would also like to completely disable logstash from creating new indexes at all … --- ## [Not performing POST when running command twice](https://discuss.elastic.co/t/not-performing-post-when-running-command-twice/248454)
**Author:** [@gdiaz](https://discuss.elastic.co/u/gdiaz)\ **Replies:** 1\ **Last updated:** [September 13, 2020, 10:28pm UTC](https://discuss.elastic.co/t/not-performing-post-when-running-command-twice/248454 "2020-09-13T22:28:00Z")
Hi all, I'm running es with the following command docker run -d -p 9200:9200 -p 9300:9300 --name=elasticsearch -e "discovery.type=single-node" -v elasticsearch-data:/usr/share/elasticsearch/data docker.elastic.co/elast… --- ## [Dashboard link on to canvas](https://discuss.elastic.co/t/dashboard-link-on-to-canvas/248451)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 2\ **Last updated:** [September 13, 2020, 7:16pm UTC](https://discuss.elastic.co/t/dashboard-link-on-to-canvas/248451 "2020-09-13T19:16:54Z")
I have multiple dashbaord and I want to put link of that in to canvas. how do I do that When I do this in tsvb or markdown it works fine \[link back to dashboard1\](#/dashboard/b9b2bee0-e5d7-11ea-ab58-ff0b09b8c93d) but… --- ## [Nested search and bulk update](https://discuss.elastic.co/t/nested-search-and-bulk-update/248421)
**Author:** [@doniv](https://discuss.elastic.co/u/doniv)\ **Replies:** 5\ **Last updated:** [September 13, 2020, 7:12pm UTC](https://discuss.elastic.co/t/nested-search-and-bulk-update/248421 "2020-09-13T19:12:44Z")
Hello, guys. I am trying to figured out the best practice to solve following case: I have two data tables in sql db: transactions and bank\_accounts (one transaction has one bank account). And i would like to search tho… --- ## [Query not working in different environments](https://discuss.elastic.co/t/query-not-working-in-different-environments/245609)
**Author:** [@gdiaz](https://discuss.elastic.co/u/gdiaz)\ **Replies:** 4\ **Last updated:** [September 13, 2020, 7:07pm UTC](https://discuss.elastic.co/t/query-not-working-in-different-environments/245609 "2020-09-13T19:07:09Z")
I have an elastic instance running in the cloud. I'm developing a REST service in Node. The same elastic instance is used when Node is in localhost and when is in develop env. When Node runs in localhost all queries work… --- ## [User credentials cannot be used for local connections](https://discuss.elastic.co/t/user-credentials-cannot-be-used-for-local-connections/247751)
**Author:** [@Adriann](https://discuss.elastic.co/u/Adriann)\ **Replies:** 2\ **Last updated:** [September 13, 2020, 5:44pm UTC](https://discuss.elastic.co/t/user-credentials-cannot-be-used-for-local-connections/247751 "2020-09-13T17:44:50Z")
Hello, I want to use WMI logstash plugin to download information from hosts. I have logstash 7.9.0 installed on Windows 2019 Terminal Server. When I use below config input { wmi { query =\> "win32\_bios" host … --- ## [Index Failover to Warm node not happening](https://discuss.elastic.co/t/index-failover-to-warm-node-not-happening/248199)
**Author:** [@ajesh](https://discuss.elastic.co/u/ajesh)\ **Replies:** 4\ **Last updated:** [September 13, 2020, 3:45pm UTC](https://discuss.elastic.co/t/index-failover-to-warm-node-not-happening/248199 "2020-09-13T15:45:13Z")
Hi Team, My index is not rolling over to Warm nodes as per the ILM policy , it just simply grows. Please see the attached . ILM policy is set to Index size 50GB or 30 Days. Index stats and screenshots attached , i could… --- ## [java.lang.NoClassDefFoundError: Could not initialize class com.sun.jna.Native](https://discuss.elastic.co/t/java-lang-noclassdeffounderror-could-not-initialize-class-com-sun-jna-native/248441)
**Author:** [@muthug](https://discuss.elastic.co/u/muthug)\ **Replies:** 13\ **Last updated:** [September 13, 2020, 3:24pm UTC](https://discuss.elastic.co/t/java-lang-noclassdeffounderror-could-not-initialize-class-com-sun-jna-native/248441 "2020-09-13T15:24:26Z")
Hi, Greetings !! I have installed ES 7.9 version and jdk 8u202 version. But unable to start the ES service. Sep 13 16:03:20 FRAKHRPL100N systemd-entrypoint\[72677\]: fatal error in thread \[main\], exiting Sep 13 16:03:2… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1808) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1810)