# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1860 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1861 --- ## [Is there a limit for the msearch?](https://discuss.elastic.co/t/is-there-a-limit-for-the-msearch/245361)
**Author:** [@richylyq](https://discuss.elastic.co/u/richylyq)\ **Replies:** 5\ **Last updated:** [August 18, 2020, 8:11am UTC](https://discuss.elastic.co/t/is-there-a-limit-for-the-msearch/245361 "2020-08-18T08:11:50Z")
i tried getting results from elastic\_client.search and elastic\_client.msearch and both returns different amount of results. and elastic\_client.search returns the most accurate result --- ## [Is possible to make a kibana data visualization like this](https://discuss.elastic.co/t/is-possible-to-make-a-kibana-data-visualization-like-this/244642)
**Author:** [@FranB](https://discuss.elastic.co/u/FranB)\ **Replies:** 3\ **Last updated:** [August 18, 2020, 8:01am UTC](https://discuss.elastic.co/t/is-possible-to-make-a-kibana-data-visualization-like-this/244642 "2020-08-18T08:01:56Z")
Hello, i'm triying to make a visualization that take 3 numbers from fileds in my index ej: total\_amount : "500" approved\_amount: "400" rejected\_amount: "100" i want to know if is possible to make one visualization wher… --- ## [Why doesn't Elastic Cloud allow multiple data nodes unless its RAM is the highest?](https://discuss.elastic.co/t/why-doesnt-elastic-cloud-allow-multiple-data-nodes-unless-its-ram-is-the-highest/245367)
**Author:** [@taichi](https://discuss.elastic.co/u/taichi)\ **Replies:** 6\ **Last updated:** [August 18, 2020, 7:57am UTC](https://discuss.elastic.co/t/why-doesnt-elastic-cloud-allow-multiple-data-nodes-unless-its-ram-is-the-highest/245367 "2020-08-18T07:57:48Z")
I'm new to Elasticsearch, and calculating the price when I use Elastic Cloud. I noticed that I can use multiple data nodes only when I use data nodes with the highest RAM settings. https://cloud.elastic.co/pricing W… --- ## [Basic License showing wrong expiration date](https://discuss.elastic.co/t/basic-license-showing-wrong-expiration-date/245237)
**Author:** [@baidwan007](https://discuss.elastic.co/u/baidwan007)\ **Replies:** 6\ **Last updated:** [August 18, 2020, 7:54am UTC](https://discuss.elastic.co/t/basic-license-showing-wrong-expiration-date/245237 "2020-08-18T07:54:33Z")
I ran the update license command on ES cluster and kibana cluster today to switch to basic license. On kibana console it shows todays date itself as expiration date. I hope this is not the real case? Does this mean s… --- ## [Invalid Yamyl Config Error: "not find expected hexdecimal number"](https://discuss.elastic.co/t/invalid-yamyl-config-error-not-find-expected-hexdecimal-number/245164)
**Author:** [@Koray\_Tugberk\_GUBUR](https://discuss.elastic.co/u/Koray_Tugberk_GUBUR)\ **Replies:** 1\ **Last updated:** [August 18, 2020, 7:27am UTC](https://discuss.elastic.co/t/invalid-yamyl-config-error-not-find-expected-hexdecimal-number/245164 "2020-08-18T07:27:56Z")
Hello, when I run the ./filebeat setup ./filebeat -e command, I got the error below: Exiting: 1 error: invalid config: yaml: line 10: did not find expected hexdecimal number Do you have any idea? This is the file's l… --- ## [Upgrading elk stack without stopping services using docker](https://discuss.elastic.co/t/upgrading-elk-stack-without-stopping-services-using-docker/245257)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 11\ **Last updated:** [August 18, 2020, 7:12am UTC](https://discuss.elastic.co/t/upgrading-elk-stack-without-stopping-services-using-docker/245257 "2020-08-18T07:12:21Z")
I have elk stack running on docker now the question is i want to upgrade to 7.8 version.Is there any way to upgrade the images of elk stack without stopping container ? --- ## [Aggregating the sum of sub-aggregation](https://discuss.elastic.co/t/aggregating-the-sum-of-sub-aggregation/245363)
**Author:** [@opentree](https://discuss.elastic.co/u/opentree)\ **Replies:** 0\ **Last updated:** [August 18, 2020, 6:53am UTC](https://discuss.elastic.co/t/aggregating-the-sum-of-sub-aggregation/245363 "2020-08-18T06:53:05Z")
I've been trying to put together an aggregation on what I would call an "intermediate bucket" (aggregating the total of a bucket). The data is coming from packetbeat, where I'm trying to aggregate the total number bytes… --- ## [Max\_concurrent\_shard\_request per node](https://discuss.elastic.co/t/max-concurrent-shard-request-per-node/245359)
**Author:** [@hamid\_bayat](https://discuss.elastic.co/u/hamid_bayat)\ **Replies:** 0\ **Last updated:** [August 18, 2020, 6:48am UTC](https://discuss.elastic.co/t/max-concurrent-shard-request-per-node/245359 "2020-08-18T06:48:08Z")
Hi I have read the elasticsearch document search API and understand Max\_concurrent\_shard\_request is used to control the maximum number of concurrent shard requests the search API will execute per node for the (per?) req… --- ## [Max\_concurrent\_shard\_requests over cross cluster search 7.5 to 6.5](https://discuss.elastic.co/t/max-concurrent-shard-requests-over-cross-cluster-search-7-5-to-6-5/245353)
**Author:** [@hamid\_bayat](https://discuss.elastic.co/u/hamid_bayat)\ **Replies:** 0\ **Last updated:** [August 18, 2020, 6:34am UTC](https://discuss.elastic.co/t/max-concurrent-shard-requests-over-cross-cluster-search-7-5-to-6-5/245353 "2020-08-18T06:34:37Z")
Hi. As you know In elasticsearch 7.x the max\_concurrent\_shard\_requests concept change from over cluster (default 256) to per node (default 5). we want to use cross cluster search from 7.5 cluster to 6.5 cluster with max… --- ## [How to run Logstash Multiple Pipelines?](https://discuss.elastic.co/t/how-to-run-logstash-multiple-pipelines/245346)
**Author:** [@Amantha](https://discuss.elastic.co/u/Amantha)\ **Replies:** 4\ **Last updated:** [August 18, 2020, 6:31am UTC](https://discuss.elastic.co/t/how-to-run-logstash-multiple-pipelines/245346 "2020-08-18T06:31:19Z")
I configured pipelines.yml file as shown as the image and i created two logstash conf files. I want to know how to run multiple pipelines. --- ## [Nested query within single index](https://discuss.elastic.co/t/nested-query-within-single-index/244937)
**Author:** [@j3grewal](https://discuss.elastic.co/u/j3grewal)\ **Replies:** 1\ **Last updated:** [August 18, 2020, 5:52am UTC](https://discuss.elastic.co/t/nested-query-within-single-index/244937 "2020-08-18T05:52:13Z")
Hi, Is there support for nested queries within a single index. I'll try to explain in SQL terms what I am trying to achieve in Elasticsearch: Say mytable has these columns: name, type, value fields in it. There can be… --- ## [How to merge 2 canvas workpads?](https://discuss.elastic.co/t/how-to-merge-2-canvas-workpads/242132)
**Author:** [@AClerk](https://discuss.elastic.co/u/AClerk)\ **Replies:** 4\ **Last updated:** [August 18, 2020, 5:30am UTC](https://discuss.elastic.co/t/how-to-merge-2-canvas-workpads/242132 "2020-08-18T05:30:05Z")
Hello, Is there a way to merge 2 (or more) canvas workpad? What will be the best solution? Thanks! --- ## [Unable to push multiline events from Filebeat to Logstash](https://discuss.elastic.co/t/unable-to-push-multiline-events-from-filebeat-to-logstash/245343)
**Author:** [@asabhyak](https://discuss.elastic.co/u/asabhyak)\ **Replies:** 0\ **Last updated:** [August 18, 2020, 4:16am UTC](https://discuss.elastic.co/t/unable-to-push-multiline-events-from-filebeat-to-logstash/245343 "2020-08-18T04:16:11Z")
Hi team, I am doing a PoC on ELK and have come across an issue. I have had a look at many topics on discuss.elastic.co and StackOverflow, but none seems to have helped. I am trying to configure multiline events via Fil… --- ## [Getting some documents ahead of my current time that alter the sql\_last\_value](https://discuss.elastic.co/t/getting-some-documents-ahead-of-my-current-time-that-alter-the-sql-last-value/241945)
**Author:** [@Incauto](https://discuss.elastic.co/u/Incauto)\ **Replies:** 4\ **Last updated:** [July 21, 2020, 4:53am UTC](https://discuss.elastic.co/t/getting-some-documents-ahead-of-my-current-time-that-alter-the-sql-last-value/241945 "2020-07-21T04:53:32Z")
I get data from a DB every 30 minutes, in the image the current time is 18:50 pm, I should have no data from 18:30 to current time because this data is collected at 19:00 pm It seems that some documents are misconfigu… --- ## [Cannot allocate because a previous copy of the primary shard existed but can no longer be found on the nodes in the cluster](https://discuss.elastic.co/t/cannot-allocate-because-a-previous-copy-of-the-primary-shard-existed-but-can-no-longer-be-found-on-the-nodes-in-the-cluster/245335)
**Author:** [@daemon](https://discuss.elastic.co/u/daemon)\ **Replies:** 8\ **Last updated:** [August 18, 2020, 4:42am UTC](https://discuss.elastic.co/t/cannot-allocate-because-a-previous-copy-of-the-primary-shard-existed-but-can-no-longer-be-found-on-the-nodes-in-the-cluster/245335 "2020-08-18T04:42:18Z")
{ "index" : "edge-access", "shard" : 0, "primary" : true, "current\_state" : "unassigned", "unassigned\_info" : { "reason" : "INDEX\_REOPENED", "at" : "2020-08-18T03:02:26.620Z", "last\_allocation\_statu… --- ## [Elasticsearch kibana 7.8 give false information ?!](https://discuss.elastic.co/t/elasticsearch-kibana-7-8-give-false-information/245333)
**Author:** [@Feriel\_Mufti](https://discuss.elastic.co/u/Feriel_Mufti)\ **Replies:** 4\ **Last updated:** [August 18, 2020, 4:41am UTC](https://discuss.elastic.co/t/elasticsearch-kibana-7-8-give-false-information/245333 "2020-08-18T04:41:17Z")
Hello , i am using Elasticsearch ,kibana and beats 7.8 , while i am using winlogbeat i have noticed illogical information , suring the last 15 min ( i didn't even open the machine that is working with winlogbeat , it… --- ## [Elasticsearch Error "Event loop shutdown"](https://discuss.elastic.co/t/elasticsearch-error-event-loop-shutdown/245329)
**Author:** [@nguacon90](https://discuss.elastic.co/u/nguacon90)\ **Replies:** 4\ **Last updated:** [August 18, 2020, 3:20am UTC](https://discuss.elastic.co/t/elasticsearch-error-event-loop-shutdown/245329 "2020-08-18T03:20:07Z")
Hi All, I'm using elastic search with information as following: { "name": "3KOuo1W", "cluster\_name": "common-cluster", "cluster\_uuid": "H9IcVILhROqC76KMneIxlA", "version": { "number": "5.5.3", … --- ## [Aggregate filter not creating path](https://discuss.elastic.co/t/aggregate-filter-not-creating-path/245299)
**Author:** [@kvtang](https://discuss.elastic.co/u/kvtang)\ **Replies:** 2\ **Last updated:** [August 18, 2020, 2:48am UTC](https://discuss.elastic.co/t/aggregate-filter-not-creating-path/245299 "2020-08-18T02:48:52Z")
Hi guys, I have used "aggregate\_maps\_path" to a folder where my logstash certainly have accessed (cause no error and that's where the logging created) but there is no map being created. Any idea why? Much thanks! --- ## [Metric beat ssl configuration is not working in linux6](https://discuss.elastic.co/t/metric-beat-ssl-configuration-is-not-working-in-linux6/245247)
**Author:** [@manojb1-in.ibm.com](https://discuss.elastic.co/u/manojb1-in.ibm.com)\ **Replies:** 1\ **Last updated:** [August 18, 2020, 1:59am UTC](https://discuss.elastic.co/t/metric-beat-ssl-configuration-is-not-working-in-linux6/245247 "2020-08-18T01:59:18Z")
Below is metricbeat.yml file etricbeat.config.modules: path: ${path.config}/modules.d/\*.yml reload.enabled: false setup.template.settings: index.number\_of\_shards: 1 index.codec: best\_compression setup.dashboard… --- ## [URL to Kibana as an interface](https://discuss.elastic.co/t/url-to-kibana-as-an-interface/245109)
**Author:** [@rsk0](https://discuss.elastic.co/u/rsk0)\ **Replies:** 6\ **Last updated:** [August 18, 2020, 1:49am UTC](https://discuss.elastic.co/t/url-to-kibana-as-an-interface/245109 "2020-08-18T01:49:42Z")
I'm wanting to form a URL from my application that can send a user into Kibana with custom parameters for dashboards or Discover searching. Is this a supported interface into Kibana? How do I responsibly link into Kiba… --- ## [Can Elasticsearch cluster appoint the shards to a specific data node?](https://discuss.elastic.co/t/can-elasticsearch-cluster-appoint-the-shards-to-a-specific-data-node/245192)
**Author:** [@Fent](https://discuss.elastic.co/u/Fent)\ **Replies:** 4\ **Last updated:** [August 18, 2020, 12:51am UTC](https://discuss.elastic.co/t/can-elasticsearch-cluster-appoint-the-shards-to-a-specific-data-node/245192 "2020-08-18T00:51:41Z")
Hi ,i have two question 1 , If Elasticsearch cluster data node can located in different cities ? for expample ,some data node server in New York and others in Washington ? 2, IF elasticsearch cluster can appiont th… --- ## [Monitoring the SFTP server availability](https://discuss.elastic.co/t/monitoring-the-sftp-server-availability/245287)
**Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\ **Replies:** 1\ **Last updated:** [August 18, 2020, 12:29am UTC](https://discuss.elastic.co/t/monitoring-the-sftp-server-availability/245287 "2020-08-18T00:29:07Z")
Is it possible to monitor the health/availability of the SFTP server using elastic Stack? --- ## [Kibana Alerts from API](https://discuss.elastic.co/t/kibana-alerts-from-api/245168)
**Author:** [@PaulMess](https://discuss.elastic.co/u/PaulMess)\ **Replies:** 9\ **Last updated:** [August 18, 2020, 12:02am UTC](https://discuss.elastic.co/t/kibana-alerts-from-api/245168 "2020-08-18T00:02:12Z")
Can I create an alert using the kibana API? --- ## [Unable to start elasticsearch 7.8 container with a password](https://discuss.elastic.co/t/unable-to-start-elasticsearch-7-8-container-with-a-password/245307)
**Author:** [@vorpal\_sledge](https://discuss.elastic.co/u/vorpal_sledge)\ **Replies:** 2\ **Last updated:** [August 17, 2020, 11:32pm UTC](https://discuss.elastic.co/t/unable-to-start-elasticsearch-7-8-container-with-a-password/245307 "2020-08-17T23:32:59Z")
Hello, I am attempting to setup an elastisearch cluster using a series of nodes which each will run a docker-compose. However, when starting up the first node I am unable to log in, and see the following error in docker… --- ## [Using High Level Rest Client in order to monitor all new records put in an index?](https://discuss.elastic.co/t/using-high-level-rest-client-in-order-to-monitor-all-new-records-put-in-an-index/245282)
**Author:** [@Rietty](https://discuss.elastic.co/u/Rietty)\ **Replies:** 0\ **Last updated:** [August 17, 2020, 4:36pm UTC](https://discuss.elastic.co/t/using-high-level-rest-client-in-order-to-monitor-all-new-records-put-in-an-index/245282 "2020-08-17T16:36:58Z")
Hi, I'm currently working with the High Level Rest Client and I'd like to set it up so that given an index, it will automatically download/get a copy of all records (i.e. Anything that happened after it was turned on) so… --- ## [How to delete all data from an index without deleting the index?](https://discuss.elastic.co/t/how-to-delete-all-data-from-an-index-without-deleting-the-index/245276)
**Author:** [@kovacsbv](https://discuss.elastic.co/u/kovacsbv)\ **Replies:** 2\ **Last updated:** [August 17, 2020, 10:30pm UTC](https://discuss.elastic.co/t/how-to-delete-all-data-from-an-index-without-deleting-the-index/245276 "2020-08-17T22:30:44Z")
Hello, I am looking for a simple and efficient way to delete all data from an index without deleting the index. This is known as a truncate in SQL parlance. The rationale is that I want to clear the data while leaving… --- ## [Downgrading from Gold licence to basic license](https://discuss.elastic.co/t/downgrading-from-gold-licence-to-basic-license/245202)
**Author:** [@baidwan007](https://discuss.elastic.co/u/baidwan007)\ **Replies:** 3\ **Last updated:** [August 17, 2020, 9:58pm UTC](https://discuss.elastic.co/t/downgrading-from-gold-licence-to-basic-license/245202 "2020-08-17T21:58:39Z")
We have a cluster with ES 7.1 where we use gold licence. We have native authentication realm (order 0) and pki realm (order 1) as auth mechanisms. xpack.security.enabled: true in elasticsearch.yaml Now we have decided… --- ## [Reporting module in Kibana](https://discuss.elastic.co/t/reporting-module-in-kibana/245185)
**Author:** [@curiousmind](https://discuss.elastic.co/u/curiousmind)\ **Replies:** 1\ **Last updated:** [August 17, 2020, 9:56pm UTC](https://discuss.elastic.co/t/reporting-module-in-kibana/245185 "2020-08-17T21:56:07Z")
can we do automatic reporting (mails) of the dashboards/visualisations using Kibana?. Since our end users would be business people and non-technical, the one mentioned in here wont help our use case. i have seen a repo… --- ## [3rd party plugin - embed data table visualization problem](https://discuss.elastic.co/t/3rd-party-plugin-embed-data-table-visualization-problem/245242)
**Author:** [@AndreaTosti](https://discuss.elastic.co/u/AndreaTosti)\ **Replies:** 1\ **Last updated:** [August 17, 2020, 9:40pm UTC](https://discuss.elastic.co/t/3rd-party-plugin-embed-data-table-visualization-problem/245242 "2020-08-17T21:40:27Z")
Hi everyone, I have a problem with a plugin developed in ReactJS. This problem occurs on Kibana versions Legacy 7.6.2, Legacy 7.7.x, Legacy 7.8.x and does NOT occur on New Platform 7.9.0. The problem concerns only the … --- ## [Connecting WinLogBeat to ElasticSearch - if I ship to LogStash, I get weird index creation. If I ship directly to ES, the connection is refused](https://discuss.elastic.co/t/connecting-winlogbeat-to-elasticsearch-if-i-ship-to-logstash-i-get-weird-index-creation-if-i-ship-directly-to-es-the-connection-is-refused/245318)
**Author:** [@apatton-cnet](https://discuss.elastic.co/u/apatton-cnet)\ **Replies:** 0\ **Last updated:** [August 17, 2020, 9:15pm UTC](https://discuss.elastic.co/t/connecting-winlogbeat-to-elasticsearch-if-i-ship-to-logstash-i-get-weird-index-creation-if-i-ship-directly-to-es-the-connection-is-refused/245318 "2020-08-17T21:15:18Z")
So I have ElasticSearch already ingesting syslogs from my Sophos-XG firewall. I have a separate logstash filter config for this input, and it all works correctly. The index name is sophos-xg-##-##-#### I wanted to start… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1859) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1861)