# Elastic Stack

**URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1849

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1850

---

## [Unable to authenticate user \[elastic\] for rest request](https://discuss.elastic.co/t/unable-to-authenticate-user-elastic-for-rest-request/246015)

<div class="topic-metadata">

**Author:** [@anil\_sunkesula](https://discuss.elastic.co/u/anil_sunkesula)\
**Replies:** 4\
**Last updated:** [August 24, 2020, 4:21am UTC](https://discuss.elastic.co/t/unable-to-authenticate-user-elastic-for-rest-request/246015 "2020-08-24T04:21:49Z")

</div>

I have launched Elasticsearch(Self-Managed) cluster using Azure marketplace. But not able to access elastic search. I tried with default user elastic and password which I gave while deploying the cluster. Getting error…

---

## [Failed to execute action {:id=\>:main, :action\_type=\>LogStash::ConvergeResult::FailedAction, :message=\>"Could not execute action: PipelineAction::Create\<main\>, action\_result: false", :backtrace=\>nil}](https://discuss.elastic.co/t/failed-to-execute-action-id-main-action-type-logstash-failedaction-message-could-not-execute-action-pipelineaction-create-main-action-result-false-backtrace-nil/245372)

<div class="topic-metadata">

**Author:** [@joel.ng](https://discuss.elastic.co/u/joel.ng)\
**Replies:** 5\
**Last updated:** [August 24, 2020, 3:29am UTC](https://discuss.elastic.co/t/failed-to-execute-action-id-main-action-type-logstash-failedaction-message-could-not-execute-action-pipelineaction-create-main-action-result-false-backtrace-nil/245372 "2020-08-24T03:29:12Z")

</div>

Trying out logstash for the first time, but I'm getting this error on a very basic localhost:5044 to S3 configuration: \[2020-08-18T08:15:53,638\]\[INFO \]\[logstash.runner \] Starting Logstash {"logstash.version"=\>"…

---

## [Elasticsearch clustering with External Storage](https://discuss.elastic.co/t/elasticsearch-clustering-with-external-storage/245215)

<div class="topic-metadata">

**Author:** [@RAM\_NATHAN](https://discuss.elastic.co/u/RAM_NATHAN)\
**Replies:** 4\
**Last updated:** [August 24, 2020, 3:07am UTC](https://discuss.elastic.co/t/elasticsearch-clustering-with-external-storage/245215 "2020-08-24T03:07:38Z")

</div>

Im having an elasticsearch cluster with local storage. Can I point all elasticsearch data nodes to same external hard disk? This will help me in Kubernetes to pull storage out of nodes/pods and keep it separate

---

## [Elasticsearch 7.9 doesn't start](https://discuss.elastic.co/t/elasticsearch-7-9-doesnt-start/245995)

<div class="topic-metadata">

**Author:** [@Peter123](https://discuss.elastic.co/u/Peter123)\
**Replies:** 3\
**Last updated:** [August 24, 2020, 1:07am UTC](https://discuss.elastic.co/t/elasticsearch-7-9-doesnt-start/245995 "2020-08-24T01:07:14Z")

</div>

I have Elasticsearch 7.9 and it doesn't start. How fix this problem? Centos 7 Java version openjdk version "1.8.0\_262" OpenJDK Runtime Environment (build 1.8.0\_262-b10) OpenJDK 64-Bit Server VM (build 25.262-b10, mi…

---

## [Ignore certain http errors using Java high level rest client](https://discuss.elastic.co/t/ignore-certain-http-errors-using-java-high-level-rest-client/245537)

<div class="topic-metadata">

**Author:** [@Wan\_Hui](https://discuss.elastic.co/u/Wan_Hui)\
**Replies:** 0\
**Last updated:** [August 19, 2020, 7:39am UTC](https://discuss.elastic.co/t/ignore-certain-http-errors-using-java-high-level-rest-client/245537 "2020-08-19T07:39:13Z")

</div>

The Javascript client allows specifying certain HTTP status codes which should not be considered as errors, as per https://www.elastic.co/guide/en/elasticsearch/client/javascript-api/current/ignore\_examples.html How can…

---

## [Reindex API not working using Java Rest High Level Client 6.6.1](https://discuss.elastic.co/t/reindex-api-not-working-using-java-rest-high-level-client-6-6-1/245835)

<div class="topic-metadata">

**Author:** [@Sunayana\_V](https://discuss.elastic.co/u/Sunayana_V)\
**Replies:** 0\
**Last updated:** [August 21, 2020, 1:22am UTC](https://discuss.elastic.co/t/reindex-api-not-working-using-java-rest-high-level-client-6-6-1/245835 "2020-08-21T01:22:03Z")

</div>

Hi all, ElasticSearch Version : 6.7 Rest Hight Level Client Version: 6.6.1 I'm trying to use Reindex API https://www.elastic.co/guide/en/elasticsearch/client/java-rest/6.6/java-rest-high-document-reindex.html Reinde…

---

## [Index not appearing in Kibana via logstash](https://discuss.elastic.co/t/index-not-appearing-in-kibana-via-logstash/244255)

<div class="topic-metadata">

**Author:** [@Umang\_Mahant](https://discuss.elastic.co/u/Umang_Mahant)\
**Replies:** 6\
**Last updated:** [August 22, 2020, 1:50pm UTC](https://discuss.elastic.co/t/index-not-appearing-in-kibana-via-logstash/244255 "2020-08-22T13:50:41Z")

</div>

Hello once again... Being new to ELK, i cannot see the index "truck" in Kibana. There is no error in logstash, i dont know if its going to elastic search, if yes i dont know y its not reaching kibana... pleasee help! …

---

## [My first centralized log server](https://discuss.elastic.co/t/my-first-centralized-log-server/246002)

<div class="topic-metadata">

**Author:** [@leostereo](https://discuss.elastic.co/u/leostereo)\
**Replies:** 5\
**Last updated:** [August 23, 2020, 10:52pm UTC](https://discuss.elastic.co/t/my-first-centralized-log-server/246002 "2020-08-23T22:52:56Z")

</div>

Hi guys , im learning elk. Just asking for some advices building my first loggin server. I need to gather al logs incoming from my mikrotik devices. Question is: What do I need to accomplish that ? (I already have m…

---

## [Rollover Indeces using Logstash and Elastic](https://discuss.elastic.co/t/rollover-indeces-using-logstash-and-elastic/243362)

<div class="topic-metadata">

**Author:** [@Kosodrom](https://discuss.elastic.co/u/Kosodrom)\
**Replies:** 13\
**Last updated:** [August 23, 2020, 10:52pm UTC](https://discuss.elastic.co/t/rollover-indeces-using-logstash-and-elastic/243362 "2020-08-23T22:52:14Z")

</div>

Hi guys, I have following use case: I want to create new index every day, therefore my logstash output configuraiton looks as this: output { elasticsearch { index =\> "metricbeat-linux-vms-%{+YYYY.MM.dd}" I also ha…

---

## [Create new aggregation index periodically](https://discuss.elastic.co/t/create-new-aggregation-index-periodically/245999)

<div class="topic-metadata">

**Author:** [@Vester](https://discuss.elastic.co/u/Vester)\
**Replies:** 2\
**Last updated:** [August 23, 2020, 9:08pm UTC](https://discuss.elastic.co/t/create-new-aggregation-index-periodically/245999 "2020-08-23T21:08:10Z")

</div>

Hi, I'm trying to create periodically a new index based on aggregation, something like: "size": 0, "aggs": { "group\_by\_xpto": { "terms": { "field": "xpto.keyword", "size": 10000 }, "aggs": { "latest\_position":…

---

## [Filtering two different time pattern in logstash](https://discuss.elastic.co/t/filtering-two-different-time-pattern-in-logstash/244370)

<div class="topic-metadata">

**Author:** [@Altair](https://discuss.elastic.co/u/Altair)\
**Replies:** 6\
**Last updated:** [August 10, 2020, 12:30pm UTC](https://discuss.elastic.co/t/filtering-two-different-time-pattern-in-logstash/244370 "2020-08-10T12:30:42Z")

</div>

Hello, I have two different time format in my logs like "Aug 10 09:18:10" and "2020-08-10T08:59:59.415319+02:00" I tried many different ways to have them in one grok but I fail date { match =\> \[ "syslog\_timestamp", "…

---

## [Unable to start elasticsearch on after enabling xpack](https://discuss.elastic.co/t/unable-to-start-elasticsearch-on-after-enabling-xpack/245996)

<div class="topic-metadata">

**Author:** [@bijender\_kr](https://discuss.elastic.co/u/bijender_kr)\
**Replies:** 0\
**Last updated:** [August 22, 2020, 8:20pm UTC](https://discuss.elastic.co/t/unable-to-start-elasticsearch-on-after-enabling-xpack/245996 "2020-08-22T20:20:19Z")

</div>

Hello, I have 4 node cluster and after enabling xpack TLS/SSL, I am having issue in starting the elasticsearch service on 2 nodes. Getting below error message on both the nodes. \[2020-08-22T14:21:40,269\]\[INFO \]\[o.e.n.N…

---

## [Integrating with mongodb, logstash, elasticsearch and kibana](https://discuss.elastic.co/t/integrating-with-mongodb-logstash-elasticsearch-and-kibana/245761)

<div class="topic-metadata">

**Author:** [@soviek](https://discuss.elastic.co/u/soviek)\
**Replies:** 2\
**Last updated:** [August 23, 2020, 4:26pm UTC](https://discuss.elastic.co/t/integrating-with-mongodb-logstash-elasticsearch-and-kibana/245761 "2020-08-23T16:26:10Z")

</div>

What is the best way to integrate more than one collection of mongodb into Kibana via Logstash and Elasticsearch. I tried below 2 options but can't see all fields in Kibana. Because of that I am not able to join 4 collec…

---

## ["Disk quota exceeded" Exception when mounting elasticsearch volume on EFS](https://discuss.elastic.co/t/disk-quota-exceeded-exception-when-mounting-elasticsearch-volume-on-efs/246021)

<div class="topic-metadata">

**Author:** [@ahmed75](https://discuss.elastic.co/u/ahmed75)\
**Replies:** 4\
**Last updated:** [August 23, 2020, 2:06pm UTC](https://discuss.elastic.co/t/disk-quota-exceeded-exception-when-mounting-elasticsearch-volume-on-efs/246021 "2020-08-23T14:06:20Z")

</div>

I'm running EFK Stack on my EKS cluster and i'm mounting elasticsearch volume on EFS so my data won't be lost when the container is restarted, however after few months my elasticsearch pod raised this exception "Disk quo…

---

## [Beats manual index template loading instructions (alternate method) is missing index alias step](https://discuss.elastic.co/t/beats-manual-index-template-loading-instructions-alternate-method-is-missing-index-alias-step/245991)

<div class="topic-metadata">

**Author:** [@alhazred](https://discuss.elastic.co/u/alhazred)\
**Replies:** 1\
**Last updated:** [August 23, 2020, 1:49pm UTC](https://discuss.elastic.co/t/beats-manual-index-template-loading-instructions-alternate-method-is-missing-index-alias-step/245991 "2020-08-23T13:49:50Z")

</div>

All the beats documentation provide instructions on loading the template index manually through an alternate method if your beat shipper doesn't have access to elasticsearch (for example: https://www.elastic.co/guide/en/…

---

## [NodeBuilder replacement](https://discuss.elastic.co/t/nodebuilder-replacement/245993)

<div class="topic-metadata">

**Author:** [@Pete\_Watcharawit](https://discuss.elastic.co/u/Pete_Watcharawit)\
**Replies:** 3\
**Last updated:** [August 23, 2020, 12:37pm UTC](https://discuss.elastic.co/t/nodebuilder-replacement/245993 "2020-08-23T12:37:00Z")

</div>

I am new to ES and trying to upgrade ES from 2.3 to 7.8. The following lines of code containing NodeBuilder are deprecated. import org.elasticsearch.common.settings.Settings; import org.elasticsearch.node.NodeBuilder; …

---

## [Ansi encoding for output of logstash](https://discuss.elastic.co/t/ansi-encoding-for-output-of-logstash/246014)

<div class="topic-metadata">

**Author:** [@sahere37](https://discuss.elastic.co/u/sahere37)\
**Replies:** 0\
**Last updated:** [August 23, 2020, 11:04am UTC](https://discuss.elastic.co/t/ansi-encoding-for-output-of-logstash/246014 "2020-08-23T11:04:41Z")

</div>

Hi all, I want to save data as a txt file based on the ansi encoding using logstash. Logstash output is as following which ANSI\_X3.4-1968 codec is used to encode output in Ansi. But, when i check the encoding of data202…

---

## [Kibana.service holdoff time over, scheduling restart](https://discuss.elastic.co/t/kibana-service-holdoff-time-over-scheduling-restart/245700)

<div class="topic-metadata">

**Author:** [@Kra3](https://discuss.elastic.co/u/Kra3)\
**Replies:** 4\
**Last updated:** [August 23, 2020, 7:43am UTC](https://discuss.elastic.co/t/kibana-service-holdoff-time-over-scheduling-restart/245700 "2020-08-23T07:43:35Z")

</div>

● kibana.service - Kibana Loaded: loaded (/etc/systemd/system/kibana.service; enabled; vendor preset: disabled) Active: active (running) since Thu 2020-08-20 04:29:53 UTC; 30s ago Main PID: 313 (node) CGroup: /system…

---

## [Graph query elasticsearch](https://discuss.elastic.co/t/graph-query-elasticsearch/246004)

<div class="topic-metadata">

**Author:** [@Abhinav\_Gandhi](https://discuss.elastic.co/u/Abhinav_Gandhi)\
**Replies:** 0\
**Last updated:** [August 23, 2020, 3:45am UTC](https://discuss.elastic.co/t/graph-query-elasticsearch/246004 "2020-08-23T03:45:54Z")

</div>

Hi, I was trying to visualise a graph in elasticsearch. The data set i am using is for contacts. Basically it has fields such as name, email, company\_name and owner\_name. The owner\_name field specifies who is the owner …

---

## [How to increase line\_merge\_size\_limit when importing from Visualizer](https://discuss.elastic.co/t/how-to-increase-line-merge-size-limit-when-importing-from-visualizer/245912)

<div class="topic-metadata">

**Author:** [@Fosiul\_Alam](https://discuss.elastic.co/u/Fosiul_Alam)\
**Replies:** 3\
**Last updated:** [August 23, 2020, 1:57am UTC](https://discuss.elastic.co/t/how-to-increase-line-merge-size-limit-when-importing-from-visualizer/245912 "2020-08-23T01:57:32Z")

</div>

Hi, I am trying to import IIS log file manually via \[Data Visualizer\] however I am keep getting bellow message. Now one solution is to increase "line\_merge\_size\_limit" Ref: https://www.elastic.co/guide/en/elasticsear…

---

## [Comparing metric over two time duration under same index](https://discuss.elastic.co/t/comparing-metric-over-two-time-duration-under-same-index/245964)

<div class="topic-metadata">

**Author:** [@SUMANTA\_ROY](https://discuss.elastic.co/u/SUMANTA_ROY)\
**Replies:** 6\
**Last updated:** [August 22, 2020, 8:45pm UTC](https://discuss.elastic.co/t/comparing-metric-over-two-time-duration-under-same-index/245964 "2020-08-22T20:45:51Z")

</div>

Hi, I am trying to find a way to visualize a bar chart displaying a metric value side by side (two different time periods), from the same index. Example : Comparing avg. attendance of class for 15 days of April month w…

---

## [ES support for spark 3.0.0](https://discuss.elastic.co/t/es-support-for-spark-3-0-0/245986)

<div class="topic-metadata">

**Author:** [@jainshasha](https://discuss.elastic.co/u/jainshasha)\
**Replies:** 1\
**Last updated:** [August 22, 2020, 7:52pm UTC](https://discuss.elastic.co/t/es-support-for-spark-3-0-0/245986 "2020-08-22T19:52:01Z")

</div>

Hi In ES-hadoop github i see this MR https://github.com/elastic/elasticsearch-hadoop/pull/1498 Would like to knw when this gonna be merge into main branch. Thanks, Shashank Jain

---

## [Data Formatter in TSVB visualization](https://discuss.elastic.co/t/data-formatter-in-tsvb-visualization/245982)

<div class="topic-metadata">

**Author:** [@hiba](https://discuss.elastic.co/u/hiba)\
**Replies:** 1\
**Last updated:** [August 22, 2020, 2:14pm UTC](https://discuss.elastic.co/t/data-formatter-in-tsvb-visualization/245982 "2020-08-22T14:14:09Z")

</div>

Hi , i use kibana 7.7.0. i create a TSVB visualization : X-axis: sum of credit and sum of debit Y-axis: date per day . in my index the fields "credit" and "debit" are a number with a format string. i like to dis…

---

## [Date field format issue](https://discuss.elastic.co/t/date-field-format-issue/245988)

<div class="topic-metadata">

**Author:** [@razor-tazor](https://discuss.elastic.co/u/razor-tazor)\
**Replies:** 3\
**Last updated:** [August 22, 2020, 1:45pm UTC](https://discuss.elastic.co/t/date-field-format-issue/245988 "2020-08-22T13:45:12Z")

</div>

I have the following query that I'm trying to run on Elasticsearch 5.6 in Kibana Dev Tools: { "query": { "bool": { "filter": { "bool": { "must": \[ { "range": {…

---

## [Exporting saved search in Discover(more than 2GB)](https://discuss.elastic.co/t/exporting-saved-search-in-discover-more-than-2gb/244393)

<div class="topic-metadata">

**Author:** [@liron\_gofberg](https://discuss.elastic.co/u/liron_gofberg)\
**Replies:** 2\
**Last updated:** [August 22, 2020, 1:42pm UTC](https://discuss.elastic.co/t/exporting-saved-search-in-discover-more-than-2gb/244393 "2020-08-22T13:42:48Z")

</div>

I have problem of exporting data of saved search when exporting more than 2 GB The error: Max attempts reached How can I fix it? Please, Thanks, Liron Gofberg

---

## [Kibana not showing all documents in index](https://discuss.elastic.co/t/kibana-not-showing-all-documents-in-index/245979)

<div class="topic-metadata">

**Author:** [@Diederik\_Mathijs](https://discuss.elastic.co/u/Diederik_Mathijs)\
**Replies:** 7\
**Last updated:** [August 22, 2020, 10:30am UTC](https://discuss.elastic.co/t/kibana-not-showing-all-documents-in-index/245979 "2020-08-22T10:30:13Z")

</div>

Hi, I'm having an issue with Kibana (I'm running es 7.9.0 and kb 7.9.0). In Kibana under my index management I see that the 'mag\_mapping' index contains 50 million documents. However, when I look in the Kibana discover …

---

## [How to enable special characters search when using simple query string](https://discuss.elastic.co/t/how-to-enable-special-characters-search-when-using-simple-query-string/245972)

<div class="topic-metadata">

**Author:** [@Dpsoniapandey](https://discuss.elastic.co/u/Dpsoniapandey)\
**Replies:** 1\
**Last updated:** [August 22, 2020, 9:58am UTC](https://discuss.elastic.co/t/how-to-enable-special-characters-search-when-using-simple-query-string/245972 "2020-08-22T09:58:07Z")

</div>

Hi Team, I have to enable search for all type of special character when using simple query string. Please help me wit analyzer and tokeniser which is to use.

---

## [Docker elasticsearch image is larger than the zip file](https://discuss.elastic.co/t/docker-elasticsearch-image-is-larger-than-the-zip-file/245949)

<div class="topic-metadata">

**Author:** [@nages](https://discuss.elastic.co/u/nages)\
**Replies:** 3\
**Last updated:** [August 22, 2020, 8:04am UTC](https://discuss.elastic.co/t/docker-elasticsearch-image-is-larger-than-the-zip-file/245949 "2020-08-22T08:04:41Z")

</div>

what was the reason the docker image is bigger than ( almost 2X) the actual zip file . I couldn't get the docker file that was used to create docker image. Is there anyway to shrink it ?

---

## [How to enable special characters search in simple query string](https://discuss.elastic.co/t/how-to-enable-special-characters-search-in-simple-query-string/245973)

<div class="topic-metadata">

**Author:** [@divya005](https://discuss.elastic.co/u/divya005)\
**Replies:** 1\
**Last updated:** [August 22, 2020, 7:30am UTC](https://discuss.elastic.co/t/how-to-enable-special-characters-search-in-simple-query-string/245973 "2020-08-22T07:30:43Z")

</div>

Hi Team, I have to enable search for all type of special character when using simple query string. Please help me wit analyzer and tokeniser which is to use. Thanks, Divya

---

## [Best approch to collect log files to elasticsearch in AIX OS](https://discuss.elastic.co/t/best-approch-to-collect-log-files-to-elasticsearch-in-aix-os/245859)

<div class="topic-metadata">

**Author:** [@renu\_jessi](https://discuss.elastic.co/u/renu_jessi)\
**Replies:** 3\
**Last updated:** [August 22, 2020, 5:40am UTC](https://discuss.elastic.co/t/best-approch-to-collect-log-files-to-elasticsearch-in-aix-os/245859 "2020-08-22T05:40:41Z")

</div>

Hi all, Iam working on elastic stack.I need to collect logs from files to create index in elasticsearch.as i can see beats and jdk dont have support in aix os.so filebeat and logstash isn't workout it seems. can u pls …

[Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1848)

[Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1850)
