# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1818 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1819 --- ## [Mapping explosion, how to refactor?](https://discuss.elastic.co/t/mapping-explosion-how-to-refactor/247473)
**Author:** [@DumpCat](https://discuss.elastic.co/u/DumpCat)\ **Replies:** 5\ **Last updated:** [September 9, 2020, 4:27am UTC](https://discuss.elastic.co/t/mapping-explosion-how-to-refactor/247473 "2020-09-09T04:27:55Z")
We have hbase with thousands of colume and sync colume data to elasticsearch periodically, but it is causing mapping explosion. Every field in elasticsearch maybe be searched by user, how do I to refactor? Thanks in adva… --- ## [Synced flush failed problem](https://discuss.elastic.co/t/synced-flush-failed-problem/247937)
**Author:** [@vincentduan](https://discuss.elastic.co/u/vincentduan)\ **Replies:** 1\ **Last updated:** [September 9, 2020, 4:00am UTC](https://discuss.elastic.co/t/synced-flush-failed-problem/247937 "2020-09-09T04:00:27Z")
Elasticsearch 6.2.3 The index has five primary shards and replicas is set to 1. Each shard is about 30GB. The cluster health is Green. And no data is being wrtten to the index. When I execute POST myindex/\_flush/synced,… --- ## [Blockchain and time series data](https://discuss.elastic.co/t/blockchain-and-time-series-data/247839)
**Author:** [@hejmaniok](https://discuss.elastic.co/u/hejmaniok)\ **Replies:** 1\ **Last updated:** [September 9, 2020, 1:42am UTC](https://discuss.elastic.co/t/blockchain-and-time-series-data/247839 "2020-09-09T01:42:20Z")
Hi everyone, We are considering using ES to index blockchain data, but before we make a move I would like to find out if with time series data it is possible to have let's say an hourly bucket and get the average of all… --- ## [Kafka String Deserializer with Logstash](https://discuss.elastic.co/t/kafka-string-deserializer-with-logstash/247693)
**Author:** [@phucsnguyenv](https://discuss.elastic.co/u/phucsnguyenv)\ **Replies:** 1\ **Last updated:** [September 9, 2020, 1:35am UTC](https://discuss.elastic.co/t/kafka-string-deserializer-with-logstash/247693 "2020-09-09T01:35:40Z")
Hi everyone I am getting a problem on pushing data from Kafka to Logstash and getting following problem. first, my data type is JSON file, original data {"key":"value"} I configured Kafka filesystem source connect to… --- ## [Logstash on AWS Elasticsearch Service - UNEXPECTED POOL ERROR | Cant install template](https://discuss.elastic.co/t/logstash-on-aws-elasticsearch-service-unexpected-pool-error-cant-install-template/247934)
**Author:** [@regic](https://discuss.elastic.co/u/regic)\ **Replies:** 5\ **Last updated:** [September 9, 2020, 1:19am UTC](https://discuss.elastic.co/t/logstash-on-aws-elasticsearch-service-unexpected-pool-error-cant-install-template/247934 "2020-09-09T01:19:09Z")
Hi, I have an Elasticsearch service running on an EC2 instance (Linux/Redhat) and I am trying to setup a Logstash service but getting a template error. Anyone have any ideas? Setup • AWS Elasticsearch 7.7 • Logstash… --- ## [Kibana : Unable to connect to Elasticsearch](https://discuss.elastic.co/t/kibana-unable-to-connect-to-elasticsearch/247687)
**Author:** [@infected](https://discuss.elastic.co/u/infected)\ **Replies:** 8\ **Last updated:** [September 9, 2020, 12:43am UTC](https://discuss.elastic.co/t/kibana-unable-to-connect-to-elasticsearch/247687 "2020-09-09T00:43:38Z")
Kibana cant connect Elasticsearch Kibana's error log log \[23:55:34.484\] \[info\]\[plugins-service\] Plugin "case" is disabled. log \[23:55:46.109\] \[info\]\[plugins-system\] Setting up \[37\] plugins: \[siem,taskManager,li… --- ## [How to keep only one version of an index / rebuild index each jdbc input](https://discuss.elastic.co/t/how-to-keep-only-one-version-of-an-index-rebuild-index-each-jdbc-input/247857)
**Author:** [@hzdb5betrieb](https://discuss.elastic.co/u/hzdb5betrieb)\ **Replies:** 0\ **Last updated:** [September 8, 2020, 9:34am UTC](https://discuss.elastic.co/t/how-to-keep-only-one-version-of-an-index-rebuild-index-each-jdbc-input/247857 "2020-09-08T09:34:45Z")
hello, we want to sync a table from an oracle database into an elasticsearch index with logstash jdbc input. the data is not timeseries data, we want to keep only one index with the current table entries (the ones from… --- ## [Debug Logstash pipeline Elastic Cloud](https://discuss.elastic.co/t/debug-logstash-pipeline-elastic-cloud/247858)
**Author:** [@captainfirebeard](https://discuss.elastic.co/u/captainfirebeard)\ **Replies:** 1\ **Last updated:** [September 9, 2020, 12:22am UTC](https://discuss.elastic.co/t/debug-logstash-pipeline-elastic-cloud/247858 "2020-09-09T00:22:01Z")
We have an Elastic Cloud subscription with one deployment (7.8). I've created a logstash pipeline on that deployment. And now i was wondering how to debug that pipeline. Since Logstash is running in the cloud I don't … --- ## [Changed JVM heap usage pattern on 7.8.1](https://discuss.elastic.co/t/changed-jvm-heap-usage-pattern-on-7-8-1/247877)
**Author:** [@Kim-Kruse-Hansen](https://discuss.elastic.co/u/Kim-Kruse-Hansen)\ **Replies:** 1\ **Last updated:** [September 9, 2020, 12:08am UTC](https://discuss.elastic.co/t/changed-jvm-heap-usage-pattern-on-7-8-1/247877 "2020-09-09T00:08:56Z")
Hi Having recently upgraded to 7.8.1 on all our clusters , we are seeing changed JVM heap usage. Our max heap usage seems to never go above around 19 GB , no matter what happens in the cluster. Same pattern on all no… --- ## [Dateparsefailure on time field](https://discuss.elastic.co/t/dateparsefailure-on-time-field/247927)
**Author:** [@ankitachow](https://discuss.elastic.co/u/ankitachow)\ **Replies:** 3\ **Last updated:** [September 8, 2020, 11:03pm UTC](https://discuss.elastic.co/t/dateparsefailure-on-time-field/247927 "2020-09-08T23:03:23Z")
I have date and time as separate fields in my input file. Date as 2019-08-28 ("yyyy-MM-dd"). Time as 09:33:05.579476547 (HH:mm:ss.SSSSSSSSZ). I want to merge the date and time for every record and create a timestamp fiel… --- ## [Intermittent errors connecting to ES cluster when using High Level Rest client](https://discuss.elastic.co/t/intermittent-errors-connecting-to-es-cluster-when-using-high-level-rest-client/247929)
**Author:** [@jdevilla20](https://discuss.elastic.co/u/jdevilla20)\ **Replies:** 0\ **Last updated:** [September 8, 2020, 10:15pm UTC](https://discuss.elastic.co/t/intermittent-errors-connecting-to-es-cluster-when-using-high-level-rest-client/247929 "2020-09-08T22:15:30Z")
Elasticsearch version ( bin/elasticsearch --version ): 7.6.2 Plugins installed : JVM version ( java -version ): sh-4.2# /usr/share/elasticsearch/jdk/bin/java -version openjdk version "13.0.2" 2020-01-14 OpenJDK … --- ## [How to harvest YAML files using Filebeat and process them in Logstash](https://discuss.elastic.co/t/how-to-harvest-yaml-files-using-filebeat-and-process-them-in-logstash/247910)
**Author:** [@abregman](https://discuss.elastic.co/u/abregman)\ **Replies:** 0\ **Last updated:** [September 8, 2020, 4:07pm UTC](https://discuss.elastic.co/t/how-to-harvest-yaml-files-using-filebeat-and-process-them-in-logstash/247910 "2020-09-08T16:07:55Z")
I have a YAML file similar to this: --- install: boot: mode: bios build: None buildmods: pin ceph: cluster: name: ceph hci: memreserve: false How can I configure filebeat to collect it a… --- ## [CPU high on Elastic cloud, instance almost stuck](https://discuss.elastic.co/t/cpu-high-on-elastic-cloud-instance-almost-stuck/247188)
**Author:** [@Daniele\_Renda](https://discuss.elastic.co/u/Daniele_Renda)\ **Replies:** 7\ **Last updated:** [September 8, 2020, 9:23pm UTC](https://discuss.elastic.co/t/cpu-high-on-elastic-cloud-instance-almost-stuck/247188 "2020-09-08T21:23:38Z")
Hi guys, I'm looking for some hint. Starting from this morning my ES instance (aws.data.highio.i3 2GB ram on Elastic cloud) is almost stuck with high load on cpu as you can see from screenshots. It seems there is no loa… --- ## [Renaming properties during reindex](https://discuss.elastic.co/t/renaming-properties-during-reindex/247926)
**Author:** [@dpr](https://discuss.elastic.co/u/dpr)\ **Replies:** 0\ **Last updated:** [September 8, 2020, 8:26pm UTC](https://discuss.elastic.co/t/renaming-properties-during-reindex/247926 "2020-09-08T20:26:30Z")
Hi! I've been successful at renaming fields during a reindex using a painless script, but I cannot figure out how to rename a (nested) property. I am trying to rename myObject.oldProperty to myObject.newProperty Here'… --- ## [Kibana discover display resets to top](https://discuss.elastic.co/t/kibana-discover-display-resets-to-top/247918)
**Author:** [@opoplawski](https://discuss.elastic.co/u/opoplawski)\ **Replies:** 2\ **Last updated:** [September 8, 2020, 8:24pm UTC](https://discuss.elastic.co/t/kibana-discover-display-resets-to-top/247918 "2020-09-08T20:24:13Z")
Running opendistroforelasticsearch-kibana-1.9.0-1.x86\_64. Recently when I scroll down in the discover results the display will reset automatically back to the top. Using Firefox 68.12.0. No indication of network activity… --- ## [Ideal Uses cases for elasticsearch Join](https://discuss.elastic.co/t/ideal-uses-cases-for-elasticsearch-join/247568)
**Author:** [@MickeyT](https://discuss.elastic.co/u/MickeyT)\ **Replies:** 6\ **Last updated:** [September 8, 2020, 7:53pm UTC](https://discuss.elastic.co/t/ideal-uses-cases-for-elasticsearch-join/247568 "2020-09-08T19:53:05Z")
If you are building a system say twitter where you anticipate replies to user tweets will be quite a lot. In addition the system will have huge user base. Is using the Join in elasticsearch ideal since you have to ensur… --- ## [How to change TSVB from an areal chart to a line chart](https://discuss.elastic.co/t/how-to-change-tsvb-from-an-areal-chart-to-a-line-chart/247893)
**Author:** [@defalt](https://discuss.elastic.co/u/defalt)\ **Replies:** 1\ **Last updated:** [September 8, 2020, 7:52pm UTC](https://discuss.elastic.co/t/how-to-change-tsvb-from-an-areal-chart-to-a-line-chart/247893 "2020-09-08T19:52:02Z")
Hi, I want to use TSVB for line charts with multiple scales. I got the multiple scales working but it lookes like it is only an areal chart. On the internet I found a picture showing a TSVB line chart: Mine looks li… --- ## [Log file parsing and ingesting into ES](https://discuss.elastic.co/t/log-file-parsing-and-ingesting-into-es/247806)
**Author:** [@ankitachow](https://discuss.elastic.co/u/ankitachow)\ **Replies:** 14\ **Last updated:** [September 8, 2020, 6:58pm UTC](https://discuss.elastic.co/t/log-file-parsing-and-ingesting-into-es/247806 "2020-09-08T18:58:36Z")
I have a log file with 1 root of xml as below. I have created a logstash parser and tested it out in manual mode and it seems to work fine. But while ingesting into ES and get the error. Input file: \ **Author:** [@AditiKhalatkar](https://discuss.elastic.co/u/AditiKhalatkar)\ **Replies:** 4\ **Last updated:** [September 8, 2020, 6:02pm UTC](https://discuss.elastic.co/t/elasticsearch-querying-time/247589 "2020-09-08T18:02:26Z") Hi all, There is a use case, where I need some help from you guys. I wonder how should I do aggregation and which method would be the best. Let's take an example. May be a school register. Having 3 fields, student\_na… --- ## [Bin/elasticsearch-setup-passwords: No such file or directory](https://discuss.elastic.co/t/bin-elasticsearch-setup-passwords-no-such-file-or-directory/247725)
**Author:** [@Bigranawab](https://discuss.elastic.co/u/Bigranawab)\ **Replies:** 3\ **Last updated:** [September 8, 2020, 5:40pm UTC](https://discuss.elastic.co/t/bin-elasticsearch-setup-passwords-no-such-file-or-directory/247725 "2020-09-08T17:40:59Z")
Hi, I am using elasticsearch 8.0 and I want to setup passwords for built-in users, so I enabled xpack.security.enabled: true and after restarting elasticsearch service I ran following command: "bin/elasticsearch-setup-p… --- ## [How to run added tests for new kibana custom plugins](https://discuss.elastic.co/t/how-to-run-added-tests-for-new-kibana-custom-plugins/247805)
**Author:** [@larryzhu](https://discuss.elastic.co/u/larryzhu)\ **Replies:** 2\ **Last updated:** [September 8, 2020, 5:21pm UTC](https://discuss.elastic.co/t/how-to-run-added-tests-for-new-kibana-custom-plugins/247805 "2020-09-08T17:21:55Z")
I added a test in JS in kibana, how do I run it? lazhu@lazhu-mac kibana % git status On branch 7.8 Your branch is ahead of 'origin/7.8' by 1 commit. (use "git push" to publish your local commits)Changes not staged fo… --- ## [ELASTICSEARCH - Sort agg values only in most recent document](https://discuss.elastic.co/t/elasticsearch-sort-agg-values-only-in-most-recent-document/247398)
**Author:** [@Miguel\_BA](https://discuss.elastic.co/u/Miguel_BA)\ **Replies:** 2\ **Last updated:** [September 8, 2020, 5:20pm UTC](https://discuss.elastic.co/t/elasticsearch-sort-agg-values-only-in-most-recent-document/247398 "2020-09-08T17:20:09Z")
I want to return the most recent document of all results of the aggregations, but it is returning all the documents How can I solve that? { "aggs": { "nested": { "nested": { "path": "data.add" … --- ## [Using exclude\_lines with json logs](https://discuss.elastic.co/t/using-exclude-lines-with-json-logs/247913)
**Author:** [@fabrizio73](https://discuss.elastic.co/u/fabrizio73)\ **Replies:** 0\ **Last updated:** [September 8, 2020, 4:32pm UTC](https://discuss.elastic.co/t/using-exclude-lines-with-json-logs/247913 "2020-09-08T16:32:52Z")
Hi, we are trying to exclude some line from our PDC Linux server, logging accesses in json format with filebeat . We just need to log real users accesses, without any log related to workstations accounts. For what we r… --- ## [Kibana Logstash Pipeline Limit?](https://discuss.elastic.co/t/kibana-logstash-pipeline-limit/247395)
**Author:** [@rmoat](https://discuss.elastic.co/u/rmoat)\ **Replies:** 2\ **Last updated:** [September 8, 2020, 3:32pm UTC](https://discuss.elastic.co/t/kibana-logstash-pipeline-limit/247395 "2020-09-08T15:32:09Z")
Hello, I'm trying to figure out if there is a limit to what is in the Logstash Pipelines within Kibana. I have a lengthy pipeline for Winlog beat, and most of all of it is working. However, I added to new filters to fi… --- ## [Filebeat to Logstash to ES](https://discuss.elastic.co/t/filebeat-to-logstash-to-es/247767)
**Author:** [@slash665](https://discuss.elastic.co/u/slash665)\ **Replies:** 15\ **Last updated:** [September 8, 2020, 3:22pm UTC](https://discuss.elastic.co/t/filebeat-to-logstash-to-es/247767 "2020-09-08T15:22:15Z")
Hello, I am trying to set up a pipeline from Filebeat to Logstash to ES, following the guide from Elastic with the tutorial logs they provide, and for the love of me I just can't get it to work. This is what I've got i… --- ## [Link a Kibana field to a URL](https://discuss.elastic.co/t/link-a-kibana-field-to-a-url/247392)
**Author:** [@dandcp](https://discuss.elastic.co/u/dandcp)\ **Replies:** 2\ **Last updated:** [September 8, 2020, 3:17pm UTC](https://discuss.elastic.co/t/link-a-kibana-field-to-a-url/247392 "2020-09-08T15:17:37Z")
I have a data table and, for the sake of making this understandable, it has several fields, but the first field is the "name". The "name" in this situation is the name of an application. I want to create the data table… --- ## [TSVB Timeline missing](https://discuss.elastic.co/t/tsvb-timeline-missing/247772)
**Author:** [@isarib](https://discuss.elastic.co/u/isarib)\ **Replies:** 9\ **Last updated:** [September 8, 2020, 2:53pm UTC](https://discuss.elastic.co/t/tsvb-timeline-missing/247772 "2020-09-08T14:53:59Z")
Displaying more than 2 days from the time picker selection will make the timeline go missing on the TSVB visualizations. Is there a fix to this? --- ## [Metric Beats Question](https://discuss.elastic.co/t/metric-beats-question/246664)
**Author:** [@bigbobolue](https://discuss.elastic.co/u/bigbobolue)\ **Replies:** 3\ **Last updated:** [September 8, 2020, 2:48pm UTC](https://discuss.elastic.co/t/metric-beats-question/246664 "2020-09-08T14:48:12Z")
Should Beats agents that I monitor with metricbeats be displayed in the Stack monitoring? --- ## [Elastalert plugin in ELK 7.9.0](https://discuss.elastic.co/t/elastalert-plugin-in-elk-7-9-0/247778)
**Author:** [@robertitox](https://discuss.elastic.co/u/robertitox)\ **Replies:** 2\ **Last updated:** [September 8, 2020, 2:14pm UTC](https://discuss.elastic.co/t/elastalert-plugin-in-elk-7-9-0/247778 "2020-09-08T14:14:22Z")
Hi people, I have an ELK 7.9.0 / Debian 10 cluster running OK. I wanna test Elastalert plugin in order to set alert rules and get feedback by email. Is it possible to put to work Elastalert for this ELK 7.9.0 version? … --- ## [Inconsistent Results/Doc Scores on Query](https://discuss.elastic.co/t/inconsistent-results-doc-scores-on-query/247418)
**Author:** [@Karl\_Kevilus](https://discuss.elastic.co/u/Karl_Kevilus)\ **Replies:** 3\ **Last updated:** [September 8, 2020, 2:09pm UTC](https://discuss.elastic.co/t/inconsistent-results-doc-scores-on-query/247418 "2020-09-08T14:09:34Z")
I'm running the same query back to back on an index and the score and results come back different when I look at explain: { … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1817) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1819)