# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1815 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1816 --- ## [Elastic Cluster Good Configuration for better performance](https://discuss.elastic.co/t/elastic-cluster-good-configuration-for-better-performance/248144)
**Author:** [@Naveena1](https://discuss.elastic.co/u/Naveena1)\ **Replies:** 1\ **Last updated:** [September 10, 2020, 10:46am UTC](https://discuss.elastic.co/t/elastic-cluster-good-configuration-for-better-performance/248144 "2020-09-10T10:46:12Z")
Hi Team, Please help me with good configuration for the cluster to improve the performance. My requirement was :- we are using Cluster 7.9.1 We have an employee table which has around 30 columns and total records i… --- ## [Create Offline Index using File](https://discuss.elastic.co/t/create-offline-index-using-file/248145)
**Author:** [@Naveena1](https://discuss.elastic.co/u/Naveena1)\ **Replies:** 1\ **Last updated:** [September 10, 2020, 10:44am UTC](https://discuss.elastic.co/t/create-offline-index-using-file/248145 "2020-09-10T10:44:07Z")
Hi , Is it possible to create offline index ?. Can we create index using a file which has data in it. --- ## [Is it normal for cluster to turn "Yellow" daily briefly during heavy indexing to existing index?](https://discuss.elastic.co/t/is-it-normal-for-cluster-to-turn-yellow-daily-briefly-during-heavy-indexing-to-existing-index/248098)
**Author:** [@vorapoap](https://discuss.elastic.co/u/vorapoap)\ **Replies:** 3\ **Last updated:** [September 10, 2020, 9:59am UTC](https://discuss.elastic.co/t/is-it-normal-for-cluster-to-turn-yellow-daily-briefly-during-heavy-indexing-to-existing-index/248098 "2020-09-10T09:59:19Z")
Cluster configuration: 3 Dedicated Master Node 15 Data nodes 0-all Replica (meaning the replica on every data node) The index is pre created. --- ## [Logstash Error while replicating Data from Oracle to Elasticsearch](https://discuss.elastic.co/t/logstash-error-while-replicating-data-from-oracle-to-elasticsearch/248140)
**Author:** [@tusharnemade](https://discuss.elastic.co/u/tusharnemade)\ **Replies:** 2\ **Last updated:** [September 10, 2020, 9:58am UTC](https://discuss.elastic.co/t/logstash-error-while-replicating-data-from-oracle-to-elasticsearch/248140 "2020-09-10T09:58:17Z")
Hi I am using Elasticsearch version 7.8.0 , Logtash version 7.8.0 RDBMS : Oracle I have configured Logstash to move data from Oracle to Elasticsearch of particular table on continuity basis. Logstash.conf file -- \> … --- ## [Restricting search on index](https://discuss.elastic.co/t/restricting-search-on-index/248141)
**Author:** [@Stephy\_Jacob](https://discuss.elastic.co/u/Stephy_Jacob)\ **Replies:** 1\ **Last updated:** [September 10, 2020, 9:56am UTC](https://discuss.elastic.co/t/restricting-search-on-index/248141 "2020-09-10T09:56:48Z")
Hi Team, We are using Standard Elastic cloud license to host our data with ES version 6.8. We are planning upgrade the ES version to 7.x soon. We have an upcoming requirement to ingest a new set of data that should no… --- ## [\[Elastic Cloud/ Elasticsearch service\] Latest change to Elasticsearch configuration failed](https://discuss.elastic.co/t/elastic-cloud-elasticsearch-service-latest-change-to-elasticsearch-configuration-failed/247781)
**Author:** [@Apollyon](https://discuss.elastic.co/u/Apollyon)\ **Replies:** 2\ **Last updated:** [September 10, 2020, 9:55am UTC](https://discuss.elastic.co/t/elastic-cloud-elasticsearch-service-latest-change-to-elasticsearch-configuration-failed/247781 "2020-09-10T09:55:13Z")
Hello, ELK 7.9.1 After a long weekend ... Have noticed something on our current deployment on Elastic Cloud/ Elasticsearch service. The below health warning as been issued and I am a little confused as to yet at the mo… --- ## [Utilising an internal floorplan as a map layer](https://discuss.elastic.co/t/utilising-an-internal-floorplan-as-a-map-layer/247860)
**Author:** [@benji87](https://discuss.elastic.co/u/benji87)\ **Replies:** 3\ **Last updated:** [September 10, 2020, 9:39am UTC](https://discuss.elastic.co/t/utilising-an-internal-floorplan-as-a-map-layer/247860 "2020-09-10T09:39:34Z")
Hi all, I just wondered whether anyone has any experience with using a custom WMS server or mapping feature for an internal structure or setting? I'm currently using the Open Street Maps WMS, and zooming in on a buildi… --- ## [Winlogbeat - multiple output](https://discuss.elastic.co/t/winlogbeat-multiple-output/248120)
**Author:** [@iccMe](https://discuss.elastic.co/u/iccMe)\ **Replies:** 1\ **Last updated:** [September 10, 2020, 9:30am UTC](https://discuss.elastic.co/t/winlogbeat-multiple-output/248120 "2020-09-10T09:30:50Z")
Hi, I am wondering if it is possible to have a winlogbeat output to multiple events? So ideally I would like it to ship to my elasticsearch cluster but also output to a file (ideally a flat file) if anyone knows if that… --- ## [Filebeat Zeek and date parsing with SMTP broken](https://discuss.elastic.co/t/filebeat-zeek-and-date-parsing-with-smtp-broken/248103)
**Author:** [@rossw](https://discuss.elastic.co/u/rossw)\ **Replies:** 1\ **Last updated:** [September 10, 2020, 9:20am UTC](https://discuss.elastic.co/t/filebeat-zeek-and-date-parsing-with-smtp-broken/248103 "2020-09-10T09:20:25Z")
Hiya I've upgraded to filebeat 7.9.0 and using the zeek (bro) module with its associated pipeline. I noticed a few entries in the dead letter queue, and a quick examination showed a parsing error on the date field of t… --- ## [How to calculate timestamp difference using Kibana scripted field feature?](https://discuss.elastic.co/t/how-to-calculate-timestamp-difference-using-kibana-scripted-field-feature/248133)
**Author:** [@Rahul\_Chougule](https://discuss.elastic.co/u/Rahul_Chougule)\ **Replies:** 1\ **Last updated:** [September 10, 2020, 9:09am UTC](https://discuss.elastic.co/t/how-to-calculate-timestamp-difference-using-kibana-scripted-field-feature/248133 "2020-09-10T09:09:06Z")
I have two date fields in my Elasticsearch index: 1. Submit\_Date & 2. Completed\_Date. I want to add new field which will be diff between Completed\_Date and Submit\_Date... but if Completed\_Date is empty I want the diff … --- ## [Unable to delete the Elasticsearch pods](https://discuss.elastic.co/t/unable-to-delete-the-elasticsearch-pods/248139)
**Author:** [@knagasri](https://discuss.elastic.co/u/knagasri)\ **Replies:** 0\ **Last updated:** [September 10, 2020, 9:04am UTC](https://discuss.elastic.co/t/unable-to-delete-the-elasticsearch-pods/248139 "2020-09-10T09:04:25Z")
we are deleting the elasticsearch cluster (deleting elasticsearch\_cr and operator files by using kubectl commad). When I am doing 'kubectl get elasticsearch' not able to see anything .But pods(elastic operator, master, d… --- ## [Failed to execute \`flush synced\`](https://discuss.elastic.co/t/failed-to-execute-flush-synced/248138)
**Author:** [@vincentduan](https://discuss.elastic.co/u/vincentduan)\ **Replies:** 0\ **Last updated:** [September 10, 2020, 9:00am UTC](https://discuss.elastic.co/t/failed-to-execute-flush-synced/248138 "2020-09-10T09:00:48Z")
Elasticsearch version 6.2.3 I execute curl -XPOST ''http://192.168.2.201:9203/myindex/\_flush/synced" . The result shows as follows: { "\_shards":{ "total": 10, "successful": 6, "failed": 4 }, "myindex" : { … --- ## [Auto-delete zipkin indices](https://discuss.elastic.co/t/auto-delete-zipkin-indices/247545)
**Author:** [@ajoshi83](https://discuss.elastic.co/u/ajoshi83)\ **Replies:** 6\ **Last updated:** [September 10, 2020, 9:00am UTC](https://discuss.elastic.co/t/auto-delete-zipkin-indices/247545 "2020-09-10T09:00:37Z")
Hi. I am using Elastic Search 7.3.1 as a storage engine for OpenZipkin. Zipkin creates a span index daily in the format "zipkin-span-YYYY-MM-dd". How I can automate the deletion of the Zipkin indices when its old than … --- ## [Can we backup log in kibana](https://discuss.elastic.co/t/can-we-backup-log-in-kibana/248102)
**Author:** [@syafeera](https://discuss.elastic.co/u/syafeera)\ **Replies:** 9\ **Last updated:** [September 10, 2020, 8:53am UTC](https://discuss.elastic.co/t/can-we-backup-log-in-kibana/248102 "2020-09-10T08:53:36Z")
Hi can we backup our log in kibana? --- ## [Very large delete\_by\_query - supported?](https://discuss.elastic.co/t/very-large-delete-by-query-supported/247891)
**Author:** [@aidofitz](https://discuss.elastic.co/u/aidofitz)\ **Replies:** 5\ **Last updated:** [September 10, 2020, 8:42am UTC](https://discuss.elastic.co/t/very-large-delete-by-query-supported/247891 "2020-09-10T08:42:25Z")
Hi, I'm trying to run a very large \_delete\_by\_query, targeting ~1.5 billion documents in an index, amounting to 100's of GB of data. This is from a single index and in the context of a overall ES cluster side of ~80Tb. … --- ## [Data Import not Analysing all Lines Present in Document](https://discuss.elastic.co/t/data-import-not-analysing-all-lines-present-in-document/248127)
**Author:** [@Broggy-Git](https://discuss.elastic.co/u/Broggy-Git)\ **Replies:** 0\ **Last updated:** [September 10, 2020, 7:54am UTC](https://discuss.elastic.co/t/data-import-not-analysing-all-lines-present-in-document/248127 "2020-09-10T07:54:01Z")
Recently I have tried to import a json file to test the visualization feature. In Visual Studio, I see that the file reaches 954 lines in length. I have noticed, however, that when imported the lines of text at the end … --- ## [Identifying corrupt indices](https://discuss.elastic.co/t/identifying-corrupt-indices/248123)
**Author:** [@Nkrb](https://discuss.elastic.co/u/Nkrb)\ **Replies:** 1\ **Last updated:** [September 10, 2020, 7:51am UTC](https://discuss.elastic.co/t/identifying-corrupt-indices/248123 "2020-09-10T07:51:34Z")
Hi All, We have a single node elasticsearch having good amount of storage. It has been working fine since last one year and suddenly stopped working, seems due to data corruption. I can see few indices, for which state… --- ## [ES shards data rebalancing](https://discuss.elastic.co/t/es-shards-data-rebalancing/248001)
**Author:** [@gintek](https://discuss.elastic.co/u/gintek)\ **Replies:** 2\ **Last updated:** [September 10, 2020, 7:07am UTC](https://discuss.elastic.co/t/es-shards-data-rebalancing/248001 "2020-09-10T07:07:25Z")
Hello, I'm wondering how are you guys doing with data rebalancing on large clusters ? We have 3 masters, 3 hot nodes and 6 cold. Some cold nodes have 4T disk and few 2T. ES is rebalancing shards based on number shards p… --- ## [Help: How to filter unwanted metadata and fields from filebeats](https://discuss.elastic.co/t/help-how-to-filter-unwanted-metadata-and-fields-from-filebeats/245685)
**Author:** [@Moksha20](https://discuss.elastic.co/u/Moksha20)\ **Replies:** 6\ **Last updated:** [September 10, 2020, 6:18am UTC](https://discuss.elastic.co/t/help-how-to-filter-unwanted-metadata-and-fields-from-filebeats/245685 "2020-09-10T06:18:10Z")
I am very new to this filebeat shipping thing. Once I ship the log to kibana I am getting so many meta data field both for kibana and filebeat...now I can filter it in kibana visualization but is there any way to filter… --- ## [Filebeat log ingestion and scan frequency](https://discuss.elastic.co/t/filebeat-log-ingestion-and-scan-frequency/248113)
**Author:** [@Moksha20](https://discuss.elastic.co/u/Moksha20)\ **Replies:** 0\ **Last updated:** [September 10, 2020, 6:14am UTC](https://discuss.elastic.co/t/filebeat-log-ingestion-and-scan-frequency/248113 "2020-09-10T06:14:22Z")
Hi Expert and Team, Could you please help me with the log ingestion from filebeat.There are two scenarios 1)My logs are created in 15 minutes frequency in the same name and replace the older one.what should my .yml fil… --- ## [Plugin - How to intercept a shard query phase and reject?](https://discuss.elastic.co/t/plugin-how-to-intercept-a-shard-query-phase-and-reject/248108)
**Author:** [@araniera](https://discuss.elastic.co/u/araniera)\ **Replies:** 0\ **Last updated:** [September 10, 2020, 5:32am UTC](https://discuss.elastic.co/t/plugin-how-to-intercept-a-shard-query-phase-and-reject/248108 "2020-09-10T05:32:00Z")
Hello, am toying with a plugin and am trying to add some behavior where I can intercept a query happening at the shard level. This can be done it seems through the SearchOperationListener with the onPreQueryPhase and on… --- ## [Elasticsearch Cluster in Docker](https://discuss.elastic.co/t/elasticsearch-cluster-in-docker/248105)
**Author:** [@muthucse](https://discuss.elastic.co/u/muthucse)\ **Replies:** 0\ **Last updated:** [September 10, 2020, 5:01am UTC](https://discuss.elastic.co/t/elasticsearch-cluster-in-docker/248105 "2020-09-10T05:01:22Z")
Planning to setup a 3 node cluster in a containerized way. Is it good to have a single VM to deploy all the three nodes and Kibana or having 3 independent VM for elasticsearch nodes ? which one is the best approach ? --- ## [How to grant read only permission to aws cognito user to access kibana](https://discuss.elastic.co/t/how-to-grant-read-only-permission-to-aws-cognito-user-to-access-kibana/248031)
**Author:** [@Dheeraj\_Bhargav](https://discuss.elastic.co/u/Dheeraj_Bhargav)\ **Replies:** 1\ **Last updated:** [September 10, 2020, 4:05am UTC](https://discuss.elastic.co/t/how-to-grant-read-only-permission-to-aws-cognito-user-to-access-kibana/248031 "2020-09-10T04:05:42Z")
How to grant read-only permission to AWS Cognito user to access kibana in read-only. The user should not change anything in kibana. --- ## [Can es shards allocate to nodes based on disk capacity？](https://discuss.elastic.co/t/can-es-shards-allocate-to-nodes-based-on-disk-capacity/248096)
**Author:** [@taidengpub](https://discuss.elastic.co/u/taidengpub)\ **Replies:** 2\ **Last updated:** [September 10, 2020, 3:25am UTC](https://discuss.elastic.co/t/can-es-shards-allocate-to-nodes-based-on-disk-capacity/248096 "2020-09-10T03:25:20Z")
https://www.elastic.co/guide/en/elasticsearch/reference/7.8/modules-cluster.html#cluster-shard-allocation-settings es doc said cluster.routing.allocation.disk.threshold\_enabled can control shard allocate when some node … --- ## [Auto\_flush\_interval not working inside my exec plugin](https://discuss.elastic.co/t/auto-flush-interval-not-working-inside-my-exec-plugin/247990)
**Author:** [@sharma\_yash](https://discuss.elastic.co/u/sharma_yash)\ **Replies:** 1\ **Last updated:** [September 10, 2020, 1:09am UTC](https://discuss.elastic.co/t/auto-flush-interval-not-working-inside-my-exec-plugin/247990 "2020-09-10T01:09:47Z")
Hi, I am executing a command using exec plugin. I am getting the response OK. I wanted to keep all the response lines in a single event. exec{ command =\> "my command" interval =\> 300 # To tackle this, I use multiline … --- ## [Setup included dashboards with custom pattern](https://discuss.elastic.co/t/setup-included-dashboards-with-custom-pattern/248088)
**Author:** [@bevano](https://discuss.elastic.co/u/bevano)\ **Replies:** 0\ **Last updated:** [September 10, 2020, 1:02am UTC](https://discuss.elastic.co/t/setup-included-dashboards-with-custom-pattern/248088 "2020-09-10T01:02:39Z")
Hi All We have setup filebeat to create a different index based on the module used. We plan on using multiple modules, like netflow, checkpoint and many more. I have configured the ILM within the filebeat.yml using this… --- ## [ElasticSearch(7.7.1) become unresponsive for sometime due to circuit breaker](https://discuss.elastic.co/t/elasticsearch-7-7-1-become-unresponsive-for-sometime-due-to-circuit-breaker/248004)
**Author:** [@het](https://discuss.elastic.co/u/het)\ **Replies:** 1\ **Last updated:** [September 9, 2020, 11:47pm UTC](https://discuss.elastic.co/t/elasticsearch-7-7-1-become-unresponsive-for-sometime-due-to-circuit-breaker/248004 "2020-09-09T23:47:11Z")
Hi Team, I am using elasticsearch 7.7.1. I have 3 data nodes(31GB) and 3 master nodes(16GB). With a heavy load, I am getting below error and I can not see my data node on the monitoring tool for 10-15 mins, also at that… --- ## [How to lock the current allocation state](https://discuss.elastic.co/t/how-to-lock-the-current-allocation-state/248072)
**Author:** [@UDixit](https://discuss.elastic.co/u/UDixit)\ **Replies:** 1\ **Last updated:** [September 9, 2020, 11:44pm UTC](https://discuss.elastic.co/t/how-to-lock-the-current-allocation-state/248072 "2020-09-09T23:44:18Z")
When cluster.routing.rebalance.enable is set to none, I understand that we are lokcing the current allocation state of the cluster. i.e. the currenlty allocated shards will not relocate to other nodes. But what happens … --- ## [Inaccessibility of Path.repo location cause primary shard corruption?](https://discuss.elastic.co/t/inaccessibility-of-path-repo-location-cause-primary-shard-corruption/248046)
**Author:** [@amit.karir](https://discuss.elastic.co/u/amit.karir)\ **Replies:** 1\ **Last updated:** [September 9, 2020, 11:39pm UTC](https://discuss.elastic.co/t/inaccessibility-of-path-repo-location-cause-primary-shard-corruption/248046 "2020-09-09T23:39:45Z")
Hi, Can Inaccessibility of Path.repo location cause primary shard corruption or being unassigned? --- ## [ELK - xpack , watcher - what to use for advanced alerting and observability?](https://discuss.elastic.co/t/elk-xpack-watcher-what-to-use-for-advanced-alerting-and-observability/247946)
**Author:** [@AwesomeRoy](https://discuss.elastic.co/u/AwesomeRoy)\ **Replies:** 5\ **Last updated:** [September 9, 2020, 11:38pm UTC](https://discuss.elastic.co/t/elk-xpack-watcher-what-to-use-for-advanced-alerting-and-observability/247946 "2020-09-09T23:38:16Z")
Kibana alerting is basic . For advanced alerts in ELK stack what should I use ? Watcher plugin ? - Is this part of paid version only ? or can i install this separately within the open n source version as well ? x-pack… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1814) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1816)