# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1835 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1836 --- ## [Blacklisting index pattern](https://discuss.elastic.co/t/blacklisting-index-pattern/246565)
**Author:** [@Kaustav\_Das](https://discuss.elastic.co/u/Kaustav_Das)\ **Replies:** 1\ **Last updated:** [August 31, 2020, 4:44am UTC](https://discuss.elastic.co/t/blacklisting-index-pattern/246565 "2020-08-31T04:44:19Z")
We have few indices which starts with predetermined prefix. If we want other indices which are created by es, kibana, monitoring tools like (monitoring-kibana, ml-state etc) to go to specefic tenant nodes tagged with adm… --- ## [ILM Hot to Warm: node does not match index setting](https://discuss.elastic.co/t/ilm-hot-to-warm-node-does-not-match-index-setting/246903)
**Author:** [@Camilo\_Diaz](https://discuss.elastic.co/u/Camilo_Diaz)\ **Replies:** 0\ **Last updated:** [August 31, 2020, 4:21am UTC](https://discuss.elastic.co/t/ilm-hot-to-warm-node-does-not-match-index-setting/246903 "2020-08-31T04:21:44Z")
Running Elasticsearch 7.7.17. I have an issue moving the indexes to the warm node. The indexes are on a healthy status (5 shards, 0 replicas) are in the right warm phase but I don't know why they don't move: GET /netw… --- ## [How to aggregate multiple Host from diffrent account in Elastic stack to support mutitenecey](https://discuss.elastic.co/t/how-to-aggregate-multiple-host-from-diffrent-account-in-elastic-stack-to-support-mutitenecey/246898)
**Author:** [@japarka2](https://discuss.elastic.co/u/japarka2)\ **Replies:** 1\ **Last updated:** [August 31, 2020, 4:13am UTC](https://discuss.elastic.co/t/how-to-aggregate-multiple-host-from-diffrent-account-in-elastic-stack-to-support-mutitenecey/246898 "2020-08-31T04:13:35Z")
How to aggregate multiple Host from different account in Elastic stack to support mutitenecey! We have thousand of thousand system(linux and Windows) from multiple account for monitoring using Beat. How we can aggregat… --- ## [Error with pyspark connect es](https://discuss.elastic.co/t/error-with-pyspark-connect-es/246560)
**Author:** [@sophieag](https://discuss.elastic.co/u/sophieag)\ **Replies:** 0\ **Last updated:** [August 27, 2020, 6:55am UTC](https://discuss.elastic.co/t/error-with-pyspark-connect-es/246560 "2020-08-27T06:55:08Z")
I use the below code to write spark dataframe data to es. df.write.format("org.elasticsearch.spark.sql").option("es.nodes","172.17.37.88,172.17.37.89,172.17.37.90").option("es.resource", "pyspark\_es/data").option("es.ma… --- ## [Elasticsearch stop working properly](https://discuss.elastic.co/t/elasticsearch-stop-working-properly/246729)
**Author:** [@esther4](https://discuss.elastic.co/u/esther4)\ **Replies:** 1\ **Last updated:** [August 31, 2020, 3:51am UTC](https://discuss.elastic.co/t/elasticsearch-stop-working-properly/246729 "2020-08-31T03:51:25Z")
One of the Elasticsearch logs shown the following warning messages after start the ES service \[2020-07-06T08:58:21,968\]Failed to update node information for ClusterInfoUpdateJob within 15s timeout \[2020-07-06T08:58:21,9… --- ## [Can not run elastic after add keystore](https://discuss.elastic.co/t/can-not-run-elastic-after-add-keystore/244347)
**Author:** [@AayushPatel](https://discuss.elastic.co/u/AayushPatel)\ **Replies:** 6\ **Last updated:** [August 31, 2020, 3:46am UTC](https://discuss.elastic.co/t/can-not-run-elastic-after-add-keystore/244347 "2020-08-31T03:46:47Z")
Hi Recently trying to use elasticsearch keystore when I trying to restart elastic service when a new key added like "mypassword" to created elasticsearch.keystore, got a weird error Aug 10 10:08:04 debian elasticsearc… --- ## [Audit log file does not appear in the node](https://discuss.elastic.co/t/audit-log-file-does-not-appear-in-the-node/246684)
**Author:** [@kasscharal](https://discuss.elastic.co/u/kasscharal)\ **Replies:** 1\ **Last updated:** [August 31, 2020, 3:43am UTC](https://discuss.elastic.co/t/audit-log-file-does-not-appear-in-the-node/246684 "2020-08-31T03:43:11Z")
In my Elasticsearch cluster (version 7.6.2 - installed using the elasticsearch.k8s.elastic.co/v1 resource) I have set xpack.security.audit.enabled to true under my nodeSets: GET /\_xpack/usage ... "audit" : { "… --- ## [Eorror "entity content is too long \[\] for the configured buffer limit \[104857600\]"](https://discuss.elastic.co/t/eorror-entity-content-is-too-long-for-the-configured-buffer-limit-104857600/246715)
**Author:** [@xodn0812](https://discuss.elastic.co/u/xodn0812)\ **Replies:** 1\ **Last updated:** [August 31, 2020, 3:41am UTC](https://discuss.elastic.co/t/eorror-entity-content-is-too-long-for-the-configured-buffer-limit-104857600/246715 "2020-08-31T03:41:45Z")
When searching for large data, a log of entity content is too long \[\] for the configured buffer limit \[104857600\] occurs. I looked up and said that I can put http.max\_content\_length, but it doesn't work. I saw some art… --- ## [Feature request / query templates reusable](https://discuss.elastic.co/t/feature-request-query-templates-reusable/246771)
**Author:** [@joropito](https://discuss.elastic.co/u/joropito)\ **Replies:** 1\ **Last updated:** [August 31, 2020, 3:37am UTC](https://discuss.elastic.co/t/feature-request-query-templates-reusable/246771 "2020-08-31T03:37:38Z")
Hi all! Please I would like to see query teamplates to be reusable on any query like this { "template\_search": { "params": { ....... these params will be used by defaults, child params supercedes this ones ..... … --- ## [Getting 504 on using aggs](https://discuss.elastic.co/t/getting-504-on-using-aggs/246807)
**Author:** [@rishav\_agarwal](https://discuss.elastic.co/u/rishav_agarwal)\ **Replies:** 1\ **Last updated:** [August 31, 2020, 3:36am UTC](https://discuss.elastic.co/t/getting-504-on-using-aggs/246807 "2020-08-31T03:36:54Z")
Hi, I am a new ES user, I type the following query, I get back results: POST /test\_index/\_search { "query": { "bool": { "filter": \[ { "term": { "id": "123456" } … --- ## [ES 7.8.0 showing some component vulnerabilities](https://discuss.elastic.co/t/es-7-8-0-showing-some-component-vulnerabilities/246787)
**Author:** [@SudhaPottipati](https://discuss.elastic.co/u/SudhaPottipati)\ **Replies:** 0\ **Last updated:** [August 28, 2020, 3:45pm UTC](https://discuss.elastic.co/t/es-7-8-0-showing-some-component-vulnerabilities/246787 "2020-08-28T15:45:13Z")
When scanned with OSS tool, we are getting some vulnerabilities with few components. Opendistro is upgraded to 1.9.0 which is latest version is any higher version with these fixes? --- ## [Always loading Elastic when i open the kibana](https://discuss.elastic.co/t/always-loading-elastic-when-i-open-the-kibana/245857)
**Author:** [@Yomike](https://discuss.elastic.co/u/Yomike)\ **Replies:** 3\ **Last updated:** [August 31, 2020, 2:10am UTC](https://discuss.elastic.co/t/always-loading-elastic-when-i-open-the-kibana/245857 "2020-08-31T02:10:57Z")
I was setting up my ELK environment first time yesterday on Windows system,but when i open the Kibana, it said Loading Elastic all the time and cannot see the dashboard .See screen shot: --- ## [Find updated documents](https://discuss.elastic.co/t/find-updated-documents/246789)
**Author:** [@mohdidriskj](https://discuss.elastic.co/u/mohdidriskj)\ **Replies:** 2\ **Last updated:** [August 31, 2020, 2:10am UTC](https://discuss.elastic.co/t/find-updated-documents/246789 "2020-08-31T02:10:36Z")
Hi, Is there a way in elastic search to trigger an alert or the entire document, whenever INSERT/UPDATE is performed on the document? --- ## [Merge multiple indexes into one index and visualize it](https://discuss.elastic.co/t/merge-multiple-indexes-into-one-index-and-visualize-it/246841)
**Author:** [@kumar4](https://discuss.elastic.co/u/kumar4)\ **Replies:** 1\ **Last updated:** [August 31, 2020, 2:06am UTC](https://discuss.elastic.co/t/merge-multiple-indexes-into-one-index-and-visualize-it/246841 "2020-08-31T02:06:26Z")
hello, I created several indexes in kibana and each each index has its own visualizations and dahsboard, the indexes have similar fields (type and meaning, I want to know it's possible to create a merge of these indexes … --- ## [Elastic search failed to start](https://discuss.elastic.co/t/elastic-search-failed-to-start/246845)
**Author:** [@cosmin\_purcarea](https://discuss.elastic.co/u/cosmin_purcarea)\ **Replies:** 1\ **Last updated:** [August 31, 2020, 2:05am UTC](https://discuss.elastic.co/t/elastic-search-failed-to-start/246845 "2020-08-31T02:05:05Z")
Hi I just try to install elasticsearch on my server but not start. ' yum info elasticsearch Loaded plugins: fastestmirror, universal-hooks Loading mirror speeds from cached hostfile \* EA4: 208.74.123.61 \* cpanel-ad… --- ## [Automatically delete month old indices every month](https://discuss.elastic.co/t/automatically-delete-month-old-indices-every-month/246535)
**Author:** [@mark.santos](https://discuss.elastic.co/u/mark.santos)\ **Replies:** 3\ **Last updated:** [August 31, 2020, 1:44am UTC](https://discuss.elastic.co/t/automatically-delete-month-old-indices-every-month/246535 "2020-08-31T01:44:35Z")
Hi everyone, I am new to Elasticsearch. I received an email notification that says " Your cluster is near its limit for storage space.". Btw, I am using function beat to transport logs from AWS Cloudwatch to Kibana. I wa… --- ## [Incomprehensible Elasticsearch behaviour](https://discuss.elastic.co/t/incomprehensible-elasticsearch-behaviour/246397)
**Author:** [@Hristo\_Angelov](https://discuss.elastic.co/u/Hristo_Angelov)\ **Replies:** 3\ **Last updated:** [August 31, 2020, 1:43am UTC](https://discuss.elastic.co/t/incomprehensible-elasticsearch-behaviour/246397 "2020-08-31T01:43:33Z")
I'm running a two nodes elasticsearch cluster(v. 5.6.10) which I monitor and I notice some interesting graphs which I can't understand. The first one is a graph of merge operations over time: As far as I can see it's … --- ## [Kibana Alerts - Log threshold keyword](https://discuss.elastic.co/t/kibana-alerts-log-threshold-keyword/246709)
**Author:** [@bevano](https://discuss.elastic.co/u/bevano)\ **Replies:** 2\ **Last updated:** [August 31, 2020, 1:31am UTC](https://discuss.elastic.co/t/kibana-alerts-log-threshold-keyword/246709 "2020-08-31T01:31:05Z")
Hi All, Trying to configure a 'Log Threshold Alert' in Kibana but running into a problem when doing a conditional statement to a field In the following image, I am trying to alert when message\_code.keyword equal XXXX. … --- ## [Minimum\_should\_match ignored when match only produces 1 term?](https://discuss.elastic.co/t/minimum-should-match-ignored-when-match-only-produces-1-term/246313)
**Author:** [@Altiano\_Gerung](https://discuss.elastic.co/u/Altiano_Gerung)\ **Replies:** 2\ **Last updated:** [August 31, 2020, 1:18am UTC](https://discuss.elastic.co/t/minimum-should-match-ignored-when-match-only-produces-1-term/246313 "2020-08-31T01:18:42Z")
"match": { "product.name.full": { "query": "chicken", "minimum\_should\_match": 3 } } will always match, but if I provide it with input that can produce \>2 terms like this: "match": { "product.name.full": … --- ## [Elastic is\_write\_index vs index\_routing in alias](https://discuss.elastic.co/t/elastic-is-write-index-vs-index-routing-in-alias/246017)
**Author:** [@Altiano\_Gerung](https://discuss.elastic.co/u/Altiano_Gerung)\ **Replies:** 5\ **Last updated:** [August 31, 2020, 1:17am UTC](https://discuss.elastic.co/t/elastic-is-write-index-vs-index-routing-in-alias/246017 "2020-08-31T01:17:55Z")
It seems like alias has the same feature with two different names, What is the different between this two actually? When to use one over the other? --- ## [Logstash input beat issue](https://discuss.elastic.co/t/logstash-input-beat-issue/246894)
**Author:** [@Carlos\_Xavier](https://discuss.elastic.co/u/Carlos_Xavier)\ **Replies:** 0\ **Last updated:** [August 30, 2020, 10:42pm UTC](https://discuss.elastic.co/t/logstash-input-beat-issue/246894 "2020-08-30T22:42:23Z")
I getting an issue between filebeat and logstash that I can not uderstand what is gonig on, I need some help with that. Let me tell you what is going on... The filebeat setting is the following.... // filebeat.inputs:… --- ## [How to map multiple patterns using dissect](https://discuss.elastic.co/t/how-to-map-multiple-patterns-using-dissect/246816)
**Author:** [@shani](https://discuss.elastic.co/u/shani)\ **Replies:** 5\ **Last updated:** [August 30, 2020, 9:43pm UTC](https://discuss.elastic.co/t/how-to-map-multiple-patterns-using-dissect/246816 "2020-08-30T21:43:03Z")
Hi all, do we have any option to map more than 1 mapping of raw event as we do with grok like grok {match =\> {"fieldname" =\> \["pattern1", "pattern2", "patternN" ...\]}} Below code gets failed if I see any different patte… --- ## [Plot a scattard graph in kibana by using 2 fields, one on y axis and other on x axis](https://discuss.elastic.co/t/plot-a-scattard-graph-in-kibana-by-using-2-fields-one-on-y-axis-and-other-on-x-axis/246887)
**Author:** [@sudhakar](https://discuss.elastic.co/u/sudhakar)\ **Replies:** 1\ **Last updated:** [August 30, 2020, 7:44pm UTC](https://discuss.elastic.co/t/plot-a-scattard-graph-in-kibana-by-using-2-fields-one-on-y-axis-and-other-on-x-axis/246887 "2020-08-30T19:44:05Z")
Hi, I have 2 fields "timestamp(Date type)" and "response(numeric type)". The response fields is storing the value of the response time for a request for the given timestamp. I want to plot a scattard graph in kibana be… --- ## [Receive notification in kibana based on specified keywords](https://discuss.elastic.co/t/receive-notification-in-kibana-based-on-specified-keywords/246695)
**Author:** [@kumar4](https://discuss.elastic.co/u/kumar4)\ **Replies:** 5\ **Last updated:** [August 30, 2020, 7:07pm UTC](https://discuss.elastic.co/t/receive-notification-in-kibana-based-on-specified-keywords/246695 "2020-08-30T19:07:22Z")
hello, is it possible to create notifications on kibana when a specific word exists in a text or in a message within a log file, ana how i can ensure that in kibana thank you --- ## [Is it possible to have Output Specific Filter or vice versa in Logstash](https://discuss.elastic.co/t/is-it-possible-to-have-output-specific-filter-or-vice-versa-in-logstash/246885)
**Author:** [@Dibyendu\_Dutta](https://discuss.elastic.co/u/Dibyendu_Dutta)\ **Replies:** 4\ **Last updated:** [August 30, 2020, 6:20pm UTC](https://discuss.elastic.co/t/is-it-possible-to-have-output-specific-filter-or-vice-versa-in-logstash/246885 "2020-08-30T18:20:08Z")
I want to have a filter specific to Kafka output . Want to send messages with specific keywords only to Kafka. For ES output want to send all messages (no filter) output { kafka { bootstrap\_servers =\> "localh… --- ## [Scheduled csv reports to email](https://discuss.elastic.co/t/scheduled-csv-reports-to-email/246884)
**Author:** [@amit\_ahuja1](https://discuss.elastic.co/u/amit_ahuja1)\ **Replies:** 7\ **Last updated:** [August 30, 2020, 5:45pm UTC](https://discuss.elastic.co/t/scheduled-csv-reports-to-email/246884 "2020-08-30T17:45:37Z")
Hello All, I am new to the elk stack and I was working with splunk earlier where we could create csv reports scheduled to email boxes at regular intervals. I am looking similar thing in ELK stack. I discovered watcher … --- ## [How to assign the extracted data from log file to new added fields](https://discuss.elastic.co/t/how-to-assign-the-extracted-data-from-log-file-to-new-added-fields/246866)
**Author:** [@sudhakar](https://discuss.elastic.co/u/sudhakar)\ **Replies:** 5\ **Last updated:** [August 30, 2020, 4:47pm UTC](https://discuss.elastic.co/t/how-to-assign-the-extracted-data-from-log-file-to-new-added-fields/246866 "2020-08-30T16:47:17Z")
Hi , I have the following logstash config for adding 2 new fields "timestamp1" and "response1" , when I use mutate block I am able to see the new fields but the data parsing is failing from the log file. filter { gr… --- ## [S3 Access denied error in s3snssqs logstash plugin](https://discuss.elastic.co/t/s3-access-denied-error-in-s3snssqs-logstash-plugin/246881)
**Author:** [@Jayakumar\_R\_R](https://discuss.elastic.co/u/Jayakumar_R_R)\ **Replies:** 0\ **Last updated:** [August 30, 2020, 3:43pm UTC](https://discuss.elastic.co/t/s3-access-denied-error-in-s3snssqs-logstash-plugin/246881 "2020-08-30T15:43:19Z")
Hi Team, input { s3snssqs { region =\> "us-east-1" s3\_default\_options =\> { "endpoint\_discovery" =\> true } queue =\> "queue name" queue\_owner\_aws\_account\_i… --- ## [Downgrade kibana version from v7.9 to v7.8](https://discuss.elastic.co/t/downgrade-kibana-version-from-v7-9-to-v7-8/246292)
**Author:** [@FATIMA\_EZZAHRA\_AIT](https://discuss.elastic.co/u/FATIMA_EZZAHRA_AIT)\ **Replies:** 17\ **Last updated:** [August 30, 2020, 2:42pm UTC](https://discuss.elastic.co/t/downgrade-kibana-version-from-v7-9-to-v7-8/246292 "2020-08-30T14:42:34Z")
Platform: Centos 7 How can I downgrade the current kibana (version 7.9) to a lower version (version 7.8) ? I do not have a backup of the previous version, is it possible to downgrade? and how can I stop kibana to upgr… --- ## [Http\_poller REST API authentication token](https://discuss.elastic.co/t/http-poller-rest-api-authentication-token/246870)
**Author:** [@joe\_good](https://discuss.elastic.co/u/joe_good)\ **Replies:** 5\ **Last updated:** [August 30, 2020, 2:07pm UTC](https://discuss.elastic.co/t/http-poller-rest-api-authentication-token/246870 "2020-08-30T14:07:12Z")
Hello, I'm trying to use logstasth http\_poller plugin to get some events from a rest API method. Before calling the events API methods, I should call the login method and get a token from its response. While I use the … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1834) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1836)