# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1832 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1833 --- ## [In\_flight\_request is too large and throw \[circuit\_breaking\_exception\] \[parent\] Data too large](https://discuss.elastic.co/t/in-flight-request-is-too-large-and-throw-circuit-breaking-exception-parent-data-too-large/246482)
**Author:** [@greyhats13](https://discuss.elastic.co/u/greyhats13)\ **Replies:** 25\ **Last updated:** [September 1, 2020, 10:21am UTC](https://discuss.elastic.co/t/in-flight-request-is-too-large-and-throw-circuit-breaking-exception-parent-data-too-large/246482 "2020-09-01T10:21:05Z")
{"statusCode":500,"error":"Internal Server Error","message":"\[parent\] Data too large, data for \[indices:data/read/get\[s\]\] would be \[32115499902/29.9gb\], which is larger than the limit of \[31621696716/29.4gb\], real usage:… --- ## [Shards unassigned after some nodes went down](https://discuss.elastic.co/t/shards-unassigned-after-some-nodes-went-down/246734)
**Author:** [@tmporary](https://discuss.elastic.co/u/tmporary)\ **Replies:** 7\ **Last updated:** [September 1, 2020, 9:51am UTC](https://discuss.elastic.co/t/shards-unassigned-after-some-nodes-went-down/246734 "2020-09-01T09:51:26Z")
Hi, We have a ES cluster consisted of 6 nodes, 3 in one data center 3 in another data center. Each of them is master eligible but 4 are data nodes. We have 3 indices, each has 5 primary shards with 1 replica. Now due to… --- ## [Drop grok failures](https://discuss.elastic.co/t/drop-grok-failures/246476)
**Author:** [@headtea](https://discuss.elastic.co/u/headtea)\ **Replies:** 9\ **Last updated:** [September 1, 2020, 9:46am UTC](https://discuss.elastic.co/t/drop-grok-failures/246476 "2020-09-01T09:46:42Z")
I use Logstash to filter data from big files like mysqld.log and mongos.log. It receives thousands of entries from these logs and I use grok to filter data and display it in Kibana. There are many entries that logstash … --- ## [Deleting indexes with ILM Policy and Index Template](https://discuss.elastic.co/t/deleting-indexes-with-ilm-policy-and-index-template/246776)
**Author:** [@RahejaGaurav](https://discuss.elastic.co/u/RahejaGaurav)\ **Replies:** 4\ **Last updated:** [September 1, 2020, 9:44am UTC](https://discuss.elastic.co/t/deleting-indexes-with-ilm-policy-and-index-template/246776 "2020-09-01T09:44:58Z")
Elasticsearch: 7.6.2, Kibana: Kibana:7.6.2 As given in the Tutorial: Automate rollover with ILM. I tried to create an ILM Policy and a simple Index template with two index pattern as given below url: /\_ilm/policy/e… --- ## [Tracer in libbeat is always enabled](https://discuss.elastic.co/t/tracer-in-libbeat-is-always-enabled/245742)
**Author:** [@newly](https://discuss.elastic.co/u/newly)\ **Replies:** 5\ **Last updated:** [September 1, 2020, 9:32am UTC](https://discuss.elastic.co/t/tracer-in-libbeat-is-always-enabled/245742 "2020-09-01T09:32:06Z")
here the tracer will always be given apm.DefaultTracer, hence these statements are always reached, and apm.DefaultTracer seems not to be fully disabled. while we don't have apm server setup/configured, StartTransaction … --- ## [Logstash error, Unable to connect with elasticsearch after enabling ssl](https://discuss.elastic.co/t/logstash-error-unable-to-connect-with-elasticsearch-after-enabling-ssl/247066)
**Author:** [@Vi\_shal](https://discuss.elastic.co/u/Vi_shal)\ **Replies:** 0\ **Last updated:** [September 1, 2020, 9:29am UTC](https://discuss.elastic.co/t/logstash-error-unable-to-connect-with-elasticsearch-after-enabling-ssl/247066 "2020-09-01T09:29:27Z")
I have an elk setup (1 master ES, 3 worker es, 1 logstash, 1 kibana) with filebeat being the log collector/emitter. Post enabling x-pack and TLS, ES and Kibana is working fine. the problem is with logstash. I'm currently… --- ## [Levenshtein distance of 2 handles same Token differently?](https://discuss.elastic.co/t/levenshtein-distance-of-2-handles-same-token-differently/247065)
**Author:** [@as\_ES](https://discuss.elastic.co/u/as_ES)\ **Replies:** 0\ **Last updated:** [September 1, 2020, 9:07am UTC](https://discuss.elastic.co/t/levenshtein-distance-of-2-handles-same-token-differently/247065 "2020-09-01T09:07:25Z")
Hi, I created two indices with the exact same mapping. The specific field has an EdgeNGram Tokenizer (Min:1 Max:50, keeping only Letters and Digits) and an analyzer with "lowercase", "asciifolding" and "synonym" filters… --- ## [Logstash - Configuring Two output plugin](https://discuss.elastic.co/t/logstash-configuring-two-output-plugin/247059)
**Author:** [@tamilarasanbravo](https://discuss.elastic.co/u/tamilarasanbravo)\ **Replies:** 1\ **Last updated:** [September 1, 2020, 8:52am UTC](https://discuss.elastic.co/t/logstash-configuring-two-output-plugin/247059 "2020-09-01T08:52:20Z")
Hi Team, Currently, I have an output plugin configured as below. I am looking for another output method to send it to mongodb. input { http { host =\> "10.199.208.43" port =\> "8080" type =\> "… --- ## [Curator\_cli rollover not generating new index](https://discuss.elastic.co/t/curator-cli-rollover-not-generating-new-index/246941)
**Author:** [@sushant4tech](https://discuss.elastic.co/u/sushant4tech)\ **Replies:** 0\ **Last updated:** [August 31, 2020, 11:21am UTC](https://discuss.elastic.co/t/curator-cli-rollover-not-generating-new-index/246941 "2020-08-31T11:21:57Z")
I am using curator version 5.8.1. I plan to replace rundeck with curator at my end. I am using curator\_cli to operate. I have curator.yml that works for me. --- client: hosts: - https://###EDITED###.us-east-1.es.a… --- ## [Doc count with Path Hierarchy](https://discuss.elastic.co/t/doc-count-with-path-hierarchy/247062)
**Author:** [@Arun\_Kumar5](https://discuss.elastic.co/u/Arun_Kumar5)\ **Replies:** 0\ **Last updated:** [September 1, 2020, 8:34am UTC](https://discuss.elastic.co/t/doc-count-with-path-hierarchy/247062 "2020-09-01T08:34:11Z")
A index doc can belongs to multiple group (path) and i aggregated search result based on group like below: below doc have two path as you can see in nested structure: "NavigationCollection": \[ { "LangId": 1, "Path":… --- ## [Give wildcard read privileges to specific documents](https://discuss.elastic.co/t/give-wildcard-read-privileges-to-specific-documents/246959)
**Author:** [@Den1](https://discuss.elastic.co/u/Den1)\ **Replies:** 4\ **Last updated:** [September 1, 2020, 8:11am UTC](https://discuss.elastic.co/t/give-wildcard-read-privileges-to-specific-documents/246959 "2020-09-01T08:11:58Z")
Hello, I added custom permissions for new role like this: {"match": {"computerName.keyword" : "HOST-depName-ABC"}} in this case user will see documents only with "HOST-depName-ABC" computerName.keyword. I want to use… --- ## [Query to get one doc out of its duplicate](https://discuss.elastic.co/t/query-to-get-one-doc-out-of-its-duplicate/246396)
**Author:** [@Manikantaks](https://discuss.elastic.co/u/Manikantaks)\ **Replies:** 2\ **Last updated:** [September 1, 2020, 7:33am UTC](https://discuss.elastic.co/t/query-to-get-one-doc-out-of-its-duplicate/246396 "2020-09-01T07:33:39Z")
I have ELK set up . In specific index there are around 70Lac records , out of which some are duplicates . I need to create a filter in kibana so that only uniq records should be return. I need to check for two field for… --- ## [Alerts and actions filters](https://discuss.elastic.co/t/alerts-and-actions-filters/246688)
**Author:** [@sfenman](https://discuss.elastic.co/u/sfenman)\ **Replies:** 2\ **Last updated:** [September 1, 2020, 7:32am UTC](https://discuss.elastic.co/t/alerts-and-actions-filters/246688 "2020-09-01T07:32:17Z")
Hello, I am using Elastic stack version 7.9. I am trying to use alerts and actions instead of watcher for my various alerts. Is it possible to filter out some documents? The only options I got is to create an alert for … --- ## [Creating "prod" cluster with ingest nodes?](https://discuss.elastic.co/t/creating-prod-cluster-with-ingest-nodes/247007)
**Author:** [@Andreas\_Falk](https://discuss.elastic.co/u/Andreas_Falk)\ **Replies:** 6\ **Last updated:** [September 1, 2020, 7:25am UTC](https://discuss.elastic.co/t/creating-prod-cluster-with-ingest-nodes/247007 "2020-09-01T07:25:30Z")
Hi, We are going to expand our test cluster with 3 "everything" nodes to split up ingest/master and data roles. We are mostly a logcluster with winlogbeat and filebeats. Something like this (sketch from supper table) :… --- ## [Elastic Agent - Windows logs + Tagging](https://discuss.elastic.co/t/elastic-agent-windows-logs-tagging/247032)
**Author:** [@danielsnelling](https://discuss.elastic.co/u/danielsnelling)\ **Replies:** 4\ **Last updated:** [September 1, 2020, 7:21am UTC](https://discuss.elastic.co/t/elastic-agent-windows-logs-tagging/247032 "2020-09-01T07:21:39Z")
Hi, does anyone know if the Elastic Agent/Ingest Manager will be getting a Winlogbeat integration module? Currently we are deploying Auditbeat/Filebeat/Metricbeat/Winlogbeat + Sysmon in a MSI bundle, as well as a separa… --- ## [StackOverFlow error in ES client](https://discuss.elastic.co/t/stackoverflow-error-in-es-client/247050)
**Author:** [@Ashwin\_Mathew](https://discuss.elastic.co/u/Ashwin_Mathew)\ **Replies:** 0\ **Last updated:** [September 1, 2020, 6:36am UTC](https://discuss.elastic.co/t/stackoverflow-error-in-es-client/247050 "2020-09-01T06:36:13Z")
Hello, I am getting the following errors at random times while indexing: https://pastebin.pl/view/a1039e86 After this happens, the ES rest client shuts down and I can't seem to process any message after that. Any hel… --- ## [Index alias with wildcard?](https://discuss.elastic.co/t/index-alias-with-wildcard/247026)
**Author:** [@AClerk](https://discuss.elastic.co/u/AClerk)\ **Replies:** 5\ **Last updated:** [September 1, 2020, 6:36am UTC](https://discuss.elastic.co/t/index-alias-with-wildcard/247026 "2020-09-01T06:36:05Z")
Hello, I am creating a daily index. Indices look like the following my-index-2020-08-31 my-index-2020-08-30 my-index-2020-08-29 my-index-yyyy-mm-dd Is t possible to add to the template an index alias with wildcard? … --- ## [How to index all fields using index action type in Watchers transform?](https://discuss.elastic.co/t/how-to-index-all-fields-using-index-action-type-in-watchers-transform/246840)
**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\ **Replies:** 1\ **Last updated:** [September 1, 2020, 6:15am UTC](https://discuss.elastic.co/t/how-to-index-all-fields-using-index-action-type-in-watchers-transform/246840 "2020-09-01T06:15:01Z")
hi friends, Currently we were alerting via email as part of watcher which makes false positives to a greater degree. So I was thinking to index all the watcher outcomes into an index and control from there. I saw bit of… --- ## [Alternative for mapping type](https://discuss.elastic.co/t/alternative-for-mapping-type/246972)
**Author:** [@Nupur](https://discuss.elastic.co/u/Nupur)\ **Replies:** 5\ **Last updated:** [September 1, 2020, 5:53am UTC](https://discuss.elastic.co/t/alternative-for-mapping-type/246972 "2020-09-01T05:53:22Z")
what is the best way to index data when i have two types .. and only one field in data is different based on the type. I have 4-5 fields for a single doc. is it good to use single index or two indexes . each for a type … --- ## [Add custom log files to stdout](https://discuss.elastic.co/t/add-custom-log-files-to-stdout/246950)
**Author:** [@knagasri](https://discuss.elastic.co/u/knagasri)\ **Replies:** 12\ **Last updated:** [September 1, 2020, 5:52am UTC](https://discuss.elastic.co/t/add-custom-log-files-to-stdout/246950 "2020-09-01T05:52:37Z")
How can we add a custom log file to stdout. For example, can we add all the logs in /var/log folder . If possible, how can we achieve that? --- ## [Kibana discover shows disabled fields in "available fields" list](https://discuss.elastic.co/t/kibana-discover-shows-disabled-fields-in-available-fields-list/246806)
**Author:** [@Limus\_Anusauskas](https://discuss.elastic.co/u/Limus_Anusauskas)\ **Replies:** 2\ **Last updated:** [September 1, 2020, 5:47am UTC](https://discuss.elastic.co/t/kibana-discover-shows-disabled-fields-in-available-fields-list/246806 "2020-09-01T05:47:24Z")
I specifically used index mapping to disable some high cardinality fields: "siteEntity": { "properties": { "defaultPlacementsForMediaType": { "type": "object", … --- ## [How to make single jdbc connection to sql server in logstash configuration instead of making connection everytime to each table](https://discuss.elastic.co/t/how-to-make-single-jdbc-connection-to-sql-server-in-logstash-configuration-instead-of-making-connection-everytime-to-each-table/247045)
**Author:** [@tharak](https://discuss.elastic.co/u/tharak)\ **Replies:** 0\ **Last updated:** [September 1, 2020, 5:44am UTC](https://discuss.elastic.co/t/how-to-make-single-jdbc-connection-to-sql-server-in-logstash-configuration-instead-of-making-connection-everytime-to-each-table/247045 "2020-09-01T05:44:04Z")
I have 10 sql tables in my database, to index all those tables data i have logstash configuration where i am making jdbc connection to each and every table. Instead of doing that how can i make a connection only once to … --- ## [Is Metricbeat meant to ship hundreds of docs per second?](https://discuss.elastic.co/t/is-metricbeat-meant-to-ship-hundreds-of-docs-per-second/244495)
**Author:** [@di.lu](https://discuss.elastic.co/u/di.lu)\ **Replies:** 5\ **Last updated:** [September 1, 2020, 5:40am UTC](https://discuss.elastic.co/t/is-metricbeat-meant-to-ship-hundreds-of-docs-per-second/244495 "2020-09-01T05:40:38Z")
Hiii All, I've just started adding Metricbeat to my K8S cluster following this tutorial: https://www.elastic.co/guide/en/beats/metricbeat/current/running-on-kubernetes.html Everything works fine and I was able to see M… --- ## [Cluster is down on 2 nodes server high disk watermark](https://discuss.elastic.co/t/cluster-is-down-on-2-nodes-server-high-disk-watermark/246859)
**Author:** [@Dilip\_Kumar](https://discuss.elastic.co/u/Dilip_Kumar)\ **Replies:** 12\ **Last updated:** [September 1, 2020, 3:42am UTC](https://discuss.elastic.co/t/cluster-is-down-on-2-nodes-server-high-disk-watermark/246859 "2020-09-01T03:42:20Z")
Hi All, I have two node cluster suddenly cluster got down. es version 5.6 and ram size of each node is 16 GB and heap size is given 8GB. I am sharing my nod1 log , please help to find solution.. \[2020-08-30T00:30:09,91… --- ## [Offloading old data to cheaper storage](https://discuss.elastic.co/t/offloading-old-data-to-cheaper-storage/247004)
**Author:** [@andywt123](https://discuss.elastic.co/u/andywt123)\ **Replies:** 2\ **Last updated:** [September 1, 2020, 3:33am UTC](https://discuss.elastic.co/t/offloading-old-data-to-cheaper-storage/247004 "2020-09-01T03:33:55Z")
We are currently using elastic to aggregate logs with filebeats. We want to be able to offload data that is older then 60 days and then store in AWS s3. The data does not need to be searchable but we may need to retrieve… --- ## [Elasticsearch service failed to start on CentOS](https://discuss.elastic.co/t/elasticsearch-service-failed-to-start-on-centos/247034)
**Author:** [@munwarrior](https://discuss.elastic.co/u/munwarrior)\ **Replies:** 1\ **Last updated:** [September 1, 2020, 3:15am UTC](https://discuss.elastic.co/t/elasticsearch-service-failed-to-start-on-centos/247034 "2020-09-01T03:15:04Z")
Hi, I've follow the steps in https://casesup.com/category/knowledgebase/installation/how-to-install-elasticsearch-on-linux-server to install elasticsearch in Centos 8. but it stuck at step 3 when I tried to create serv… --- ## [Throttle the ES-Hadoop write speed](https://discuss.elastic.co/t/throttle-the-es-hadoop-write-speed/246702)
**Author:** [@chenchuangc](https://discuss.elastic.co/u/chenchuangc)\ **Replies:** 2\ **Last updated:** [September 1, 2020, 2:31am UTC](https://discuss.elastic.co/t/throttle-the-es-hadoop-write-speed/246702 "2020-09-01T02:31:04Z")
1. problem background I am using an elasticsearch cluster to save the result from spark2.3. Also this cluster offer an online query . My spark task is a daily work that will write 6 million records to ES cluster every … --- ## [How to centre the text in the dashboard visualisation? I am really struggling to center the text without the top white portion](https://discuss.elastic.co/t/how-to-centre-the-text-in-the-dashboard-visualisation-i-am-really-struggling-to-center-the-text-without-the-top-white-portion/246828)
**Author:** [@krishnendu](https://discuss.elastic.co/u/krishnendu)\ **Replies:** 2\ **Last updated:** [September 1, 2020, 1:07am UTC](https://discuss.elastic.co/t/how-to-centre-the-text-in-the-dashboard-visualisation-i-am-really-struggling-to-center-the-text-without-the-top-white-portion/246828 "2020-09-01T01:07:21Z")
--- ## [Replacement for setTypes(list of types) in 7.8 version - can we pass multiple indices to SearchRequest](https://discuss.elastic.co/t/replacement-for-settypes-list-of-types-in-7-8-version-can-we-pass-multiple-indices-to-searchrequest/247022)
**Author:** [@elastic78](https://discuss.elastic.co/u/elastic78)\ **Replies:** 1\ **Last updated:** [August 31, 2020, 11:11pm UTC](https://discuss.elastic.co/t/replacement-for-settypes-list-of-types-in-7-8-version-can-we-pass-multiple-indices-to-searchrequest/247022 "2020-08-31T23:11:42Z")
In 5.5.2 version we had a search query as shown below which uses settypes array(basically list of types). SearchRequestBuilder searchBuilder = client.prepareSearch(index).setTypes((String) types.toArray(new String\[types… --- ## [Ilm-history-2-000001 UNASSIGNED, primary shard for this replica is not yet active](https://discuss.elastic.co/t/ilm-history-2-000001-unassigned-primary-shard-for-this-replica-is-not-yet-active/246978)
**Author:** [@Petr.Simik](https://discuss.elastic.co/u/Petr.Simik)\ **Replies:** 3\ **Last updated:** [August 31, 2020, 9:44pm UTC](https://discuss.elastic.co/t/ilm-history-2-000001-unassigned-primary-shard-for-this-replica-is-not-yet-active/246978 "2020-08-31T21:44:17Z")
Please I need critical help with cluster in state RED after upgrade 7.4.2-\>7.9 during upgrade of 5th node of 15 it did not recover it health to 100% but 99% all indices are green except 2 shards index … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1831) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1833)