# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1856 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1857 --- ## [Understanding of recommended ES Cluster Architecture](https://discuss.elastic.co/t/understanding-of-recommended-es-cluster-architecture/243243)
**Author:** [@neldreth](https://discuss.elastic.co/u/neldreth)\ **Replies:** 5\ **Last updated:** [July 31, 2020, 5:47pm UTC](https://discuss.elastic.co/t/understanding-of-recommended-es-cluster-architecture/243243 "2020-07-31T17:47:21Z")
I am currently working on designing a ELK Domain via AWS ES Service, and I trying to decided how many dedicated master, data, ingest, etc. nodes I require. I am ingesting data from AWS Cloudtrail via Lambda, bringing in… --- ## [Multiple filters with Ruby DSL](https://discuss.elastic.co/t/multiple-filters-with-ruby-dsl/245417)
**Author:** [@ozgurozan](https://discuss.elastic.co/u/ozgurozan)\ **Replies:** 1\ **Last updated:** [August 19, 2020, 12:24pm UTC](https://discuss.elastic.co/t/multiple-filters-with-ruby-dsl/245417 "2020-08-19T12:24:44Z")
Hi I'm trying to implement multiple filters inside one query with Ruby DSL API, but couldn't figure out how to do it from the documentation. Since "filtered" queries are removed since ES 2.0 I have to use the "boolean" … --- ## [New module in Filebeat for custom logs analysis](https://discuss.elastic.co/t/new-module-in-filebeat-for-custom-logs-analysis/245598)
**Author:** [@Damecharla\_Tharun](https://discuss.elastic.co/u/Damecharla_Tharun)\ **Replies:** 0\ **Last updated:** [August 19, 2020, 12:22pm UTC](https://discuss.elastic.co/t/new-module-in-filebeat-for-custom-logs-analysis/245598 "2020-08-19T12:22:40Z")
Hi All, I want to create a new module in filebeat for data patterns for logs will be different. Need a help what are the pre requistes to create custom modul in order to develop one of our client to analyze IBM Webspher… --- ## [Filebeats only sends logs when I have filebeat -e running](https://discuss.elastic.co/t/filebeats-only-sends-logs-when-i-have-filebeat-e-running/245088)
**Author:** [@plegault](https://discuss.elastic.co/u/plegault)\ **Replies:** 10\ **Last updated:** [August 19, 2020, 11:58am UTC](https://discuss.elastic.co/t/filebeats-only-sends-logs-when-i-have-filebeat-e-running/245088 "2020-08-19T11:58:57Z")
I'm new to configuring ELK stack. I had it setup without ssl and with ssl and back to without ssl. I did this because I was not able to get apache and mysql to send logs to the elk stack. I tried to send it to output.ela… --- ## [Logstash plugin development; dev container image; review requested](https://discuss.elastic.co/t/logstash-plugin-development-dev-container-image-review-requested/245589)
**Author:** [@cknz](https://discuss.elastic.co/u/cknz)\ **Replies:** 0\ **Last updated:** [August 19, 2020, 11:32am UTC](https://discuss.elastic.co/t/logstash-plugin-development-dev-container-image-review-requested/245589 "2020-08-19T11:32:59Z")
Hi everyone, particularly those with an interest in Logstash plugin development and build tooling. I'm tooling up to do some logstash plugin development, and found myself going a bit crazy getting my development environ… --- ## [Query connected and seperated words (ie: everybody - every body)](https://discuss.elastic.co/t/query-connected-and-seperated-words-ie-everybody-every-body/245403)
**Author:** [@ziv](https://discuss.elastic.co/u/ziv)\ **Replies:** 5\ **Last updated:** [August 19, 2020, 11:32am UTC](https://discuss.elastic.co/t/query-connected-and-seperated-words-ie-everybody-every-body/245403 "2020-08-19T11:32:04Z")
I have a document with the following description: "we have a lot of skin care products". and when I'm trying to query with the word "skincare" I get score 0. is there a tokenizer for this case? to treat words like ski… --- ## [Managing kibana for multiple users](https://discuss.elastic.co/t/managing-kibana-for-multiple-users/245412)
**Author:** [@Dipak\_Sharma](https://discuss.elastic.co/u/Dipak_Sharma)\ **Replies:** 8\ **Last updated:** [August 19, 2020, 11:28am UTC](https://discuss.elastic.co/t/managing-kibana-for-multiple-users/245412 "2020-08-19T11:28:31Z")
I want to create a user with read access of one index of kibana. --- ## [Elastic Search Remove Elements From Nested Object](https://discuss.elastic.co/t/elastic-search-remove-elements-from-nested-object/245587)
**Author:** [@surajdalvi](https://discuss.elastic.co/u/surajdalvi)\ **Replies:** 0\ **Last updated:** [August 19, 2020, 11:25am UTC](https://discuss.elastic.co/t/elastic-search-remove-elements-from-nested-object/245587 "2020-08-19T11:25:04Z")
I have created an index in elastic search with a nested type field. and added documents into the index. Now I want to remove some elements from nested objects who match the condition using UpdateByQuery. I have tried the… --- ## [Api key & error](https://discuss.elastic.co/t/api-key-error/243873)
**Author:** [@maxxitutti](https://discuss.elastic.co/u/maxxitutti)\ **Replies:** 5\ **Last updated:** [August 19, 2020, 11:11am UTC](https://discuss.elastic.co/t/api-key-error/243873 "2020-08-19T11:11:48Z")
Hello . i am new with elk sollution co forgive me :). i want to run my first beat on my remote machine ... from the begining i want to deploy api-key for my auditbeat. according to documentation https://www.elastic.co… --- ## [Issue setting up Index Lifecycle policy correctly](https://discuss.elastic.co/t/issue-setting-up-index-lifecycle-policy-correctly/241469)
**Author:** [@ozonshak](https://discuss.elastic.co/u/ozonshak)\ **Replies:** 4\ **Last updated:** [August 19, 2020, 11:05am UTC](https://discuss.elastic.co/t/issue-setting-up-index-lifecycle-policy-correctly/241469 "2020-08-19T11:05:20Z")
Hello. I'm new to setting up a proper Lifecycle policy, so I'm hoping someone can please give me a hand with this. So, I have an existing index getting created on a weekly basis. This is a third party integration (the… --- ## [How to fix heap size problem against big data (CircuitBreakingException)](https://discuss.elastic.co/t/how-to-fix-heap-size-problem-against-big-data-circuitbreakingexception/245554)
**Author:** [@Farid\_N](https://discuss.elastic.co/u/Farid_N)\ **Replies:** 3\ **Last updated:** [August 19, 2020, 10:55am UTC](https://discuss.elastic.co/t/how-to-fix-heap-size-problem-against-big-data-circuitbreakingexception/245554 "2020-08-19T10:55:45Z")
Hi I have an issue with my cluster. I want to know how can I fix the heap memory against big data? Consider that I can\`t increase the size or another memory... What is the solution? --- ## [Ways to run es on arm/alpha architecture with lower es-versions](https://discuss.elastic.co/t/ways-to-run-es-on-arm-alpha-architecture-with-lower-es-versions/245561)
**Author:** [@duanyongvictory](https://discuss.elastic.co/u/duanyongvictory)\ **Replies:** 1\ **Last updated:** [August 19, 2020, 10:43am UTC](https://discuss.elastic.co/t/ways-to-run-es-on-arm-alpha-architecture-with-lower-es-versions/245561 "2020-08-19T10:43:30Z")
Hi all: Does anyone know how to run es on arm/alpha architecture with lower es-version? my es version is 5.4.2 and with lots of application running on it. I can only found es version 7.8.0 which is suitable for arm, … --- ## [How to externalise painless scripts and call it](https://discuss.elastic.co/t/how-to-externalise-painless-scripts-and-call-it/245497)
**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\ **Replies:** 2\ **Last updated:** [August 19, 2020, 10:31am UTC](https://discuss.elastic.co/t/how-to-externalise-painless-scripts-and-call-it/245497 "2020-08-19T10:31:30Z")
hi I have looked into the few examples, of painless script https://www.elastic.co/guide/en/elasticsearch/painless/current/painless-execute-api.html A current example shown is POST /\_scripts/painless/\_execute { "scr… --- ## [Filebeat Module won't process incomming syslogs](https://discuss.elastic.co/t/filebeat-module-wont-process-incomming-syslogs/245442)
**Author:** [@Moritz\_Kiesewetter](https://discuss.elastic.co/u/Moritz_Kiesewetter)\ **Replies:** 2\ **Last updated:** [August 19, 2020, 7:27am UTC](https://discuss.elastic.co/t/filebeat-module-wont-process-incomming-syslogs/245442 "2020-08-19T07:27:17Z")
Hi guys, so i i'm using filebeat modules (asa,cisco,fortinet and palo alto) to parse the syslogs of different firewalls. Everything is working fine, expect for the pan module: I enabled the module - and configured the… --- ## [How to filter a field with entries of different version number formats in Elasticsearch documents](https://discuss.elastic.co/t/how-to-filter-a-field-with-entries-of-different-version-number-formats-in-elasticsearch-documents/245427)
**Author:** [@siiman](https://discuss.elastic.co/u/siiman)\ **Replies:** 3\ **Last updated:** [August 19, 2020, 10:28am UTC](https://discuss.elastic.co/t/how-to-filter-a-field-with-entries-of-different-version-number-formats-in-elasticsearch-documents/245427 "2020-08-19T10:28:23Z")
Hello, everyone, how to filter and sort a field with entries of different version numbers in Elasticsearch documents? For example different documents contain the field version with entries like "10.0", "10.1.5", "9" or… --- ## [Help needed in refactoring Elasticsearch Query](https://discuss.elastic.co/t/help-needed-in-refactoring-elasticsearch-query/245581)
**Author:** [@prasad98](https://discuss.elastic.co/u/prasad98)\ **Replies:** 0\ **Last updated:** [August 19, 2020, 10:23am UTC](https://discuss.elastic.co/t/help-needed-in-refactoring-elasticsearch-query/245581 "2020-08-19T10:23:41Z")
I am trying to refactor a elasticsearch query from written for 2.4 (it's a very old one) and want to make it compatible for elasticsearch 7.5 Here is my structured query: { 'query': { 'filtered': { 'filter'… --- ## [Color in a field in the dashboard](https://discuss.elastic.co/t/color-in-a-field-in-the-dashboard/245218)
**Author:** [@vikramaddagulla](https://discuss.elastic.co/u/vikramaddagulla)\ **Replies:** 10\ **Last updated:** [August 19, 2020, 10:16am UTC](https://discuss.elastic.co/t/color-in-a-field-in-the-dashboard/245218 "2020-08-19T10:16:05Z")
Hello, I would like to know if its possible to display colored fields based on the message. For ex : If a server down is down, I would get the status as UP or DOWN on the dashboard. I would like to modify it as If th… --- ## [Elasticsearch query timeout](https://discuss.elastic.co/t/elasticsearch-query-timeout/245579)
**Author:** [@ubazu](https://discuss.elastic.co/u/ubazu)\ **Replies:** 0\ **Last updated:** [August 19, 2020, 10:05am UTC](https://discuss.elastic.co/t/elasticsearch-query-timeout/245579 "2020-08-19T10:05:17Z")
I am running an ES node on a 8 cores/16G RAM Qbox server. I am doing some indexing and search operations. indexing(max 5/second), search(max 14/second). My index has around 2M records and 1.2G of data. Search query take… --- ## [ADD FIELD OVERWRITES DATA](https://discuss.elastic.co/t/add-field-overwrites-data/244008)
**Author:** [@Daniel\_Lopez](https://discuss.elastic.co/u/Daniel_Lopez)\ **Replies:** 3\ **Last updated:** [August 19, 2020, 9:57am UTC](https://discuss.elastic.co/t/add-field-overwrites-data/244008 "2020-08-19T09:57:46Z")
Hi guys, I'm trying to add data in a field like an array, but my grok or mutate overwrites it, could someone take a look? This is my code: \`filter { if \[message\] =~ "TargetID:" { drop{} } grok { patterns\_dir =\> \[… --- ## [GET query replacing "+" sign from document id](https://discuss.elastic.co/t/get-query-replacing-sign-from-document-id/245574)
**Author:** [@rahulkothanath](https://discuss.elastic.co/u/rahulkothanath)\ **Replies:** 0\ **Last updated:** [August 19, 2020, 9:50am UTC](https://discuss.elastic.co/t/get-query-replacing-sign-from-document-id/245574 "2020-08-19T09:50:17Z")
when I am searching for a document using "\_id" ,GET query is replacing "+" sign in the id with empty space. below is my id and query. id: 2FDC1B4CF35B1A29A5F1FA232410B08887B40E46EMD5DOHcKn5R+q6Wiipsx8Hkg==202008180133… --- ## [Get the total number of fields of a given index](https://discuss.elastic.co/t/get-the-total-number-of-fields-of-a-given-index/245566)
**Author:** [@CanardMoussant](https://discuss.elastic.co/u/CanardMoussant)\ **Replies:** 0\ **Last updated:** [August 19, 2020, 9:28am UTC](https://discuss.elastic.co/t/get-the-total-number-of-fields-of-a-given-index/245566 "2020-08-19T09:28:10Z")
I am facing update mapping errors on an ES (6.1) index because it seems we reached the limit index.mapping.total\_fields.limit. The error is: Limit of total fields \[1200\] in index \[coin\] has been exceeded However, if I … --- ## [Getting GC overhead on Elasticsearch](https://discuss.elastic.co/t/getting-gc-overhead-on-elasticsearch/245526)
**Author:** [@AshokBachchan](https://discuss.elastic.co/u/AshokBachchan)\ **Replies:** 6\ **Last updated:** [August 19, 2020, 9:15am UTC](https://discuss.elastic.co/t/getting-gc-overhead-on-elasticsearch/245526 "2020-08-19T09:15:40Z")
Hi, We were getting more GC on elasticsearch. Please help me, due to this issue, ES node crashing suddenly { "\_nodes": { "total": 9, "successful": 9, "failed": 0 }, "cluster\_name": "AWS-Pre-Productio… --- ## [Does IDF count documents that don't have a field](https://discuss.elastic.co/t/does-idf-count-documents-that-dont-have-a-field/245562)
**Author:** [@ivanibash](https://discuss.elastic.co/u/ivanibash)\ **Replies:** 0\ **Last updated:** [August 19, 2020, 9:10am UTC](https://discuss.elastic.co/t/does-idf-count-documents-that-dont-have-a-field/245562 "2020-08-19T09:10:11Z")
First let me check my assumption is correct . As i understand ES calculates IDF across specific fields. So when I read things like "It is a ratio of all documents to documents containing the searched term." it really mea… --- ## [All nodes green, cluster yellow (or green?)](https://discuss.elastic.co/t/all-nodes-green-cluster-yellow-or-green/245485)
**Author:** [@tarkhil](https://discuss.elastic.co/u/tarkhil)\ **Replies:** 4\ **Last updated:** [August 19, 2020, 8:09am UTC](https://discuss.elastic.co/t/all-nodes-green-cluster-yellow-or-green/245485 "2020-08-19T08:09:02Z")
Hello I'm running ElasticSearch 6.8.(mix of 8 and 10). Kibana shows that all nodes are green, but cluster is yellow. Graylog disagrees with Kibana - "Elasticsearch cluster is green". What's happening, what should I f… --- ## [Tail mode in logstash file input is not reading the recently uploaded files](https://discuss.elastic.co/t/tail-mode-in-logstash-file-input-is-not-reading-the-recently-uploaded-files/245538)
**Author:** [@akshatha](https://discuss.elastic.co/u/akshatha)\ **Replies:** 0\ **Last updated:** [August 19, 2020, 7:40am UTC](https://discuss.elastic.co/t/tail-mode-in-logstash-file-input-is-not-reading-the-recently-uploaded-files/245538 "2020-08-19T07:40:18Z")
Hi , I am providing csv file as input to logstash and defined tail mode, but tail mode is not working. the modified files are not getting appended and logstash is reading all the files, but i want it to read the recent… --- ## [ELK version 7.8.1 : Kibana took longer time to start](https://discuss.elastic.co/t/elk-version-7-8-1-kibana-took-longer-time-to-start/245514)
**Author:** [@Hung\_M\_Le](https://discuss.elastic.co/u/Hung_M_Le)\ **Replies:** 4\ **Last updated:** [August 19, 2020, 7:28am UTC](https://discuss.elastic.co/t/elk-version-7-8-1-kibana-took-longer-time-to-start/245514 "2020-08-19T07:28:56Z")
Hi I just recently upgraded my Elastic Docker image to use the version 7.8.1 and I notice the Kibana component took abnormally longer time to start. Thus, I observe lots of print from filebeat that It cannot connect to … --- ## [How to stop elastic search if number of data nodes are less than minimum?](https://discuss.elastic.co/t/how-to-stop-elastic-search-if-number-of-data-nodes-are-less-than-minimum/245535)
**Author:** [@Pavan\_Rajan](https://discuss.elastic.co/u/Pavan_Rajan)\ **Replies:** 0\ **Last updated:** [August 19, 2020, 7:14am UTC](https://discuss.elastic.co/t/how-to-stop-elastic-search-if-number-of-data-nodes-are-less-than-minimum/245535 "2020-08-19T07:14:38Z")
Say I have deployed 2 data nodes with number of replicas as default 1. If the second node goes down, the cluster health will turn yellow, but will still continue to function. Is there any configuration to stop this beha… --- ## [\_reindex call - Access current object in destination](https://discuss.elastic.co/t/reindex-call-access-current-object-in-destination/245527)
**Author:** [@anitabee](https://discuss.elastic.co/u/anitabee)\ **Replies:** 0\ **Last updated:** [August 19, 2020, 6:19am UTC](https://discuss.elastic.co/t/reindex-call-access-current-object-in-destination/245527 "2020-08-19T06:19:44Z")
Hi, During reindex call is it possible to access current object in destination that is going to be overridden? What I'm trying to achieve is this: POST \_reindex { "source": { "remote": { "host": "https://e… --- ## [Getting ssl error while trying to create httpclient](https://discuss.elastic.co/t/getting-ssl-error-while-trying-to-create-httpclient/245327)
**Author:** [@elastic78](https://discuss.elastic.co/u/elastic78)\ **Replies:** 16\ **Last updated:** [August 19, 2020, 6:12am UTC](https://discuss.elastic.co/t/getting-ssl-error-while-trying-to-create-httpclient/245327 "2020-08-19T06:12:59Z")
I am getting the below error while trying to create new http client in 7.8.1 version. Please help. code : RestHighLevelClient client = new RestHighLevelClient(RestClient. builder ( new HttpHost(getLocalHost(), getPort(… --- ## [Data node CPU utilization goes very high](https://discuss.elastic.co/t/data-node-cpu-utilization-goes-very-high/245464)
**Author:** [@sheetal.nainwal](https://discuss.elastic.co/u/sheetal.nainwal)\ **Replies:** 3\ **Last updated:** [August 19, 2020, 6:06am UTC](https://discuss.elastic.co/t/data-node-cpu-utilization-goes-very-high/245464 "2020-08-19T06:06:42Z")
I am using AWS ElasticSearch service and the problem I am facing while ingestion happens on one index, it serves Very high CPU utilization (sometimes 1 or 2 master/data node goes down and sometimes ingestion fails). As r… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1855) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1857)