# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1875 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1876 --- ## [Too many field in metricbeat](https://discuss.elastic.co/t/too-many-field-in-metricbeat/242572)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 8\ **Last updated:** [August 11, 2020, 12:55pm UTC](https://discuss.elastic.co/t/too-many-field-in-metricbeat/242572 "2020-08-11T12:55:03Z")
When I start the metricbeat it loads about 3000 field. I know it is loading default template. even when I have only one module.d/system.yml file. how do I only load system template? --- ## [Imports cannot resolved to a type](https://discuss.elastic.co/t/imports-cannot-resolved-to-a-type/244551)
**Author:** [@mun-inder-jeet-singh](https://discuss.elastic.co/u/mun-inder-jeet-singh)\ **Replies:** 0\ **Last updated:** [August 11, 2020, 12:52pm UTC](https://discuss.elastic.co/t/imports-cannot-resolved-to-a-type/244551 "2020-08-11T12:52:14Z")
Hi All I have cloned the repo from github and imported into eclipse. There are imports error for groovy classes only which i need to resolve. Kindly guide . P.S. All the necessary files which needs to be imported is… --- ## [Query Performance in ES](https://discuss.elastic.co/t/query-performance-in-es/244342)
**Author:** [@randidwiputra](https://discuss.elastic.co/u/randidwiputra)\ **Replies:** 5\ **Last updated:** [August 11, 2020, 12:24pm UTC](https://discuss.elastic.co/t/query-performance-in-es/244342 "2020-08-11T12:24:25Z")
Hi All, I need suggestions if we have data 6TB with 10 datanode ES, how about query performance in Elasticsearch. Can the query be successful in 2 seconds? Every nodes are 8 core, 64GB RAM, 6TB SSD. Thanks All --- ## [How to use ingest pipeline with logstash elaticsearch output update feature](https://discuss.elastic.co/t/how-to-use-ingest-pipeline-with-logstash-elaticsearch-output-update-feature/244314)
**Author:** [@nuwancs](https://discuss.elastic.co/u/nuwancs)\ **Replies:** 1\ **Last updated:** [August 11, 2020, 12:19pm UTC](https://discuss.elastic.co/t/how-to-use-ingest-pipeline-with-logstash-elaticsearch-output-update-feature/244314 "2020-08-11T12:19:33Z")
I am using Logstash Elasticsearch output to publish data to Elasticsearch. Two records are merged to create a single record from a request and a response. This code is working with no issues. elasticsearch { hosts =\> … --- ## [Line visualization](https://discuss.elastic.co/t/line-visualization/244003)
**Author:** [@hiba](https://discuss.elastic.co/u/hiba)\ **Replies:** 5\ **Last updated:** [August 11, 2020, 12:10pm UTC](https://discuss.elastic.co/t/line-visualization/244003 "2020-08-11T12:10:16Z")
Hi , I use kibana 7.7.0 how can i dislay values in a line visualization. for example : axe X : date (i can display it ) axe Y : price ( I want to display the prices of each document as in discover , without any fun… --- ## [Filebeat didn't drop some of the fields like agent.\*, ecs.\* etc](https://discuss.elastic.co/t/filebeat-didnt-drop-some-of-the-fields-like-agent-ecs-etc/243911)
**Author:** [@mohanr](https://discuss.elastic.co/u/mohanr)\ **Replies:** 2\ **Last updated:** [August 11, 2020, 11:52am UTC](https://discuss.elastic.co/t/filebeat-didnt-drop-some-of-the-fields-like-agent-ecs-etc/243911 "2020-08-11T11:52:53Z")
Hi, I am using filebeat with a docker processor. Filebeat generate some fields like agent, ecs etc. I am trying to remove these fields using drop\_fields processor. filebeat.inputs: - type: docker containers.ids: … --- ## [Multi node fail](https://discuss.elastic.co/t/multi-node-fail/244244)
**Author:** [@cadirol](https://discuss.elastic.co/u/cadirol)\ **Replies:** 15\ **Last updated:** [August 11, 2020, 11:47am UTC](https://discuss.elastic.co/t/multi-node-fail/244244 "2020-08-11T11:47:35Z")
Hi All For operational continuity in an multinode cluster i have two questions in my head: the cluster contains, 14 nodes, 7 nodes on site A, 7 nodes on site B, ES Version 6.4 What if a) one site goes down unexpected … --- ## [Elasticsearch SSL Certificate Invalid](https://discuss.elastic.co/t/elasticsearch-ssl-certificate-invalid/244538)
**Author:** [@saravananselvamohan](https://discuss.elastic.co/u/saravananselvamohan)\ **Replies:** 0\ **Last updated:** [August 11, 2020, 11:32am UTC](https://discuss.elastic.co/t/elasticsearch-ssl-certificate-invalid/244538 "2020-08-11T11:32:45Z")
Software: Elastics v5.5.0 Hardware: Ubuntu 20 I am trying to set up SSL/TLS on the cluster. Steps I followed: bin/x-pack/certgen Please enter the desired output file \[/home/es/config/x-pack/csr-bundle.zip\]:… --- ## [Using a codec with the BigQuery output plugin](https://discuss.elastic.co/t/using-a-codec-with-the-bigquery-output-plugin/241510)
**Author:** [@James\_Sherwood\_Jones](https://discuss.elastic.co/u/James_Sherwood_Jones)\ **Replies:** 1\ **Last updated:** [August 11, 2020, 11:15am UTC](https://discuss.elastic.co/t/using-a-codec-with-the-bigquery-output-plugin/241510 "2020-08-11T11:15:56Z")
I've set a codec on the BigQuery output plugin in my pipeline: google\_bigquery { codec =\> "my-custom-codec" ... } The codec itself works great with an output like "stdout" but I've spent a considerable amount of ti… --- ## [Coordinate map on 7.7.0 - "change precision on map zoom" feature broken?](https://discuss.elastic.co/t/coordinate-map-on-7-7-0-change-precision-on-map-zoom-feature-broken/244386)
**Author:** [@tallavi](https://discuss.elastic.co/u/tallavi)\ **Replies:** 2\ **Last updated:** [August 11, 2020, 10:37am UTC](https://discuss.elastic.co/t/coordinate-map-on-7-7-0-change-precision-on-map-zoom-feature-broken/244386 "2020-08-11T10:37:33Z")
Hi all, We've upgraded from 7.5.0 to 7.7.0 and something got broken in our coordinate maps. I load my dashboard and everything looks ok, but then I zoom out or change the data, and instead of many small circles, I see … --- ## [Load Balancing Elasticsearch Hot Nodes](https://discuss.elastic.co/t/load-balancing-elasticsearch-hot-nodes/244531)
**Author:** [@jijo.john](https://discuss.elastic.co/u/jijo.john)\ **Replies:** 0\ **Last updated:** [August 11, 2020, 10:23am UTC](https://discuss.elastic.co/t/load-balancing-elasticsearch-hot-nodes/244531 "2020-08-11T10:23:13Z")
Hi All, We have a query for elasticsearch node redundancy. Can we use a AWS NLB/ALB to load balance the Hot Nodes so that in the Node failure data will still be pushed to another active hot node under the load balancer … --- ## [Cannot allocate because allocation is not permitted to any of the nodes](https://discuss.elastic.co/t/cannot-allocate-because-allocation-is-not-permitted-to-any-of-the-nodes/244530)
**Author:** [@Dipesh](https://discuss.elastic.co/u/Dipesh)\ **Replies:** 0\ **Last updated:** [August 11, 2020, 10:16am UTC](https://discuss.elastic.co/t/cannot-allocate-because-allocation-is-not-permitted-to-any-of-the-nodes/244530 "2020-08-11T10:16:53Z")
Hi , we are facing issue on elasticsearch, when we are adding replica 1 and shrads 1 on templates then iml policy is not working properly. indices are not moving from warm to cold phase and delete phase. { "index" … --- ## [Query on Source only snapshot](https://discuss.elastic.co/t/query-on-source-only-snapshot/242919)
**Author:** [@jijo.john](https://discuss.elastic.co/u/jijo.john)\ **Replies:** 11\ **Last updated:** [August 11, 2020, 10:10am UTC](https://discuss.elastic.co/t/query-on-source-only-snapshot/242919 "2020-08-11T10:10:33Z")
Hello Team, I am currently testing snapshot and restore process in elasticsearch. After restoring a source only snapshot from s3 , it is not showing any doc counts and storage size. do we need to do any thing here to st… --- ## [Is it able to get rank (order number) of \_score in Elasticsearch script score?](https://discuss.elastic.co/t/is-it-able-to-get-rank-order-number-of-score-in-elasticsearch-script-score/244527)
**Author:** [@taichi](https://discuss.elastic.co/u/taichi)\ **Replies:** 0\ **Last updated:** [August 11, 2020, 9:51am UTC](https://discuss.elastic.co/t/is-it-able-to-get-rank-order-number-of-score-in-elasticsearch-script-score/244527 "2020-08-11T09:51:44Z")
I would like to use \_score in script score, calculating its rank in entire hits. For example, if there are these 3 hit documents; { "\_id": 1, "\_score": 0.7 } { "\_id": 2, "\_score": 0.5 } { "\_id": 3, "\_score": 1.0 } I w… --- ## [Paging and sorting results after a term aggregation by doc fields](https://discuss.elastic.co/t/paging-and-sorting-results-after-a-term-aggregation-by-doc-fields/244526)
**Author:** [@Walter\_Chicca](https://discuss.elastic.co/u/Walter_Chicca)\ **Replies:** 0\ **Last updated:** [August 11, 2020, 9:50am UTC](https://discuss.elastic.co/t/paging-and-sorting-results-after-a-term-aggregation-by-doc-fields/244526 "2020-08-11T09:50:38Z")
Hi everyone, what i'm trying to do is sorting the results from a term aggregation using the fields in the starting document, the final goal is to be able sorting and paging a datatable server side because there're too m… --- ## [Monitor elasticsearch with metricbeat, cannot get "index" metricset](https://discuss.elastic.co/t/monitor-elasticsearch-with-metricbeat-cannot-get-index-metricset/243816)
**Author:** [@ebuildy](https://discuss.elastic.co/u/ebuildy)\ **Replies:** 7\ **Last updated:** [August 11, 2020, 9:11am UTC](https://discuss.elastic.co/t/monitor-elasticsearch-with-metricbeat-cannot-get-index-metricset/243816 "2020-08-11T09:11:09Z")
I am running on kubernetes, with elastic Helm, 3 master nodes and 3 data nodes. Metricbeat elastic Helm to run metricbeat. I configure metricbeat to monitor my 6 nodes ES cluster, and give it as elasticsearch host the m… --- ## [Hot - Warm Architecture with 3 Node Cluster](https://discuss.elastic.co/t/hot-warm-architecture-with-3-node-cluster/244496)
**Author:** [@rakesh15](https://discuss.elastic.co/u/rakesh15)\ **Replies:** 6\ **Last updated:** [August 11, 2020, 8:48am UTC](https://discuss.elastic.co/t/hot-warm-architecture-with-3-node-cluster/244496 "2020-08-11T08:48:37Z")
Hi Team, I'm trying to create the 3 Node Elasticsearch Cluster to store the time series logging data. The shards will have only 1 replication count to minimize the storage utilization. Need help to understand the below… --- ## [Exiting: resource 'metricbeat-7.8.0' exists, but it is not an alias](https://discuss.elastic.co/t/exiting-resource-metricbeat-7-8-0-exists-but-it-is-not-an-alias/244507)
**Author:** [@elastic8](https://discuss.elastic.co/u/elastic8)\ **Replies:** 0\ **Last updated:** [August 11, 2020, 8:10am UTC](https://discuss.elastic.co/t/exiting-resource-metricbeat-7-8-0-exists-but-it-is-not-an-alias/244507 "2020-08-11T08:10:45Z")
we have more than 50 server running and we installed metricbeat 7.6.2 and in some server 7.8.0 but whenver we are tying to setup (metricbeat setup) cmd it show below error Exiting: resource 'metricbeat-7.8.0' exists, bu… --- ## [Unable to install offline plugin analysis-icu-7.3.1.zip - error - NoSuchFileException](https://discuss.elastic.co/t/unable-to-install-offline-plugin-analysis-icu-7-3-1-zip-error-nosuchfileexception/244348)
**Author:** [@WaseemSiddiqui](https://discuss.elastic.co/u/WaseemSiddiqui)\ **Replies:** 2\ **Last updated:** [August 11, 2020, 8:08am UTC](https://discuss.elastic.co/t/unable-to-install-offline-plugin-analysis-icu-7-3-1-zip-error-nosuchfileexception/244348 "2020-08-11T08:08:56Z")
On Elastic Search 7.3.1 version I am installing Plugin - analysis-icu-7.3.1.zip in offline mode. while passing the command: elasticsearch-plugin.bat install file:///mypath/analysis-icu-7.3.1.zip Unfortunately I am ge… --- ## [Request Rate changes at a specific hour](https://discuss.elastic.co/t/request-rate-changes-at-a-specific-hour/244291)
**Author:** [@Burga](https://discuss.elastic.co/u/Burga)\ **Replies:** 5\ **Last updated:** [August 11, 2020, 8:05am UTC](https://discuss.elastic.co/t/request-rate-changes-at-a-specific-hour/244291 "2020-08-11T08:05:23Z")
Hi i'm handling request rate degradation and I noticed that some of my nodes behaving strange , exactly at 03:04 every night request rate Either drops from 900 to 200 or climb up from 200 to 900 I'm not sure this is … --- ## [Tomcat dashboard](https://discuss.elastic.co/t/tomcat-dashboard/244505)
**Author:** [@tomang](https://discuss.elastic.co/u/tomang)\ **Replies:** 0\ **Last updated:** [August 11, 2020, 7:57am UTC](https://discuss.elastic.co/t/tomcat-dashboard/244505 "2020-08-11T07:57:31Z")
Hello, I am using metricbeat 7.8.1. I notice that under $METRICBEAT\_HOME/kibana/7/dashboard, there is no the default tomcat dashboard ( Metricbeat-Tomcat-overview.json ). But the json is available on github, that I copi… --- ## [Kibana dashboard without timestamp field](https://discuss.elastic.co/t/kibana-dashboard-without-timestamp-field/243850)
**Author:** [@Alexandros888](https://discuss.elastic.co/u/Alexandros888)\ **Replies:** 2\ **Last updated:** [August 11, 2020, 7:48am UTC](https://discuss.elastic.co/t/kibana-dashboard-without-timestamp-field/243850 "2020-08-11T07:48:32Z")
Hello, I have created a dashboard in kibana. All 2 objects of that dashboard are generated from the index pattern of the following image that do not contain a timestamp field because i dont need it. My problem is th… --- ## [Delete\_by\_query performance optimization](https://discuss.elastic.co/t/delete-by-query-performance-optimization/244437)
**Author:** [@nickgregz](https://discuss.elastic.co/u/nickgregz)\ **Replies:** 4\ **Last updated:** [August 11, 2020, 7:48am UTC](https://discuss.elastic.co/t/delete-by-query-performance-optimization/244437 "2020-08-11T07:48:03Z")
Hello, Multiple topics mention time-based indices as a go to method for clearing old (index) data but in cases where that is not possible the alternative is delete\_by\_query which poses a performance impact if we are wor… --- ## [Kibana visualization - Count occurence of term in multiple fields](https://discuss.elastic.co/t/kibana-visualization-count-occurence-of-term-in-multiple-fields/244405)
**Author:** [@Ilya\_Geller](https://discuss.elastic.co/u/Ilya_Geller)\ **Replies:** 4\ **Last updated:** [August 11, 2020, 7:37am UTC](https://discuss.elastic.co/t/kibana-visualization-count-occurence-of-term-in-multiple-fields/244405 "2020-08-11T07:37:39Z")
Hello, I have index that containts documents with fields: source\_address and destination\_address for each event. I would like to create a visualization in Kibana to show the top 10 most popular addresses in the databas… --- ## [Filebeat AWS Module Errors and Missing Logs](https://discuss.elastic.co/t/filebeat-aws-module-errors-and-missing-logs/244503)
**Author:** [@johnnywalker](https://discuss.elastic.co/u/johnnywalker)\ **Replies:** 0\ **Last updated:** [August 11, 2020, 7:36am UTC](https://discuss.elastic.co/t/filebeat-aws-module-errors-and-missing-logs/244503 "2020-08-11T07:36:17Z")
Prior to our 7.8 migration, we used our own cloudtrail worker(golang + logstash) but wanted to adopt the aws filebeat module for ECS conversion. Upon doing so I notice a significant drop in log volume(500GB -\> 30GB), mi… --- ## [Help, Cannot get multiline to work correctly](https://discuss.elastic.co/t/help-cannot-get-multiline-to-work-correctly/244161)
**Author:** [@calanon](https://discuss.elastic.co/u/calanon)\ **Replies:** 5\ **Last updated:** [August 11, 2020, 7:36am UTC](https://discuss.elastic.co/t/help-cannot-get-multiline-to-work-correctly/244161 "2020-08-11T07:36:20Z")
I have this raw log output: \[2020-08-07T12:45:33+02:00\] 10.8.0.84 ERROR Exception: \{"exception":"\[object\] (UnexpectedValueException(code: 0): This is to simulate uncaught exceptions at /home/app1/products/s… --- ## [Elasticsearch 7.6 is underperforming 6.8](https://discuss.elastic.co/t/elasticsearch-7-6-is-underperforming-6-8/244211)
**Author:** [@danksim](https://discuss.elastic.co/u/danksim)\ **Replies:** 17\ **Last updated:** [August 11, 2020, 7:18am UTC](https://discuss.elastic.co/t/elasticsearch-7-6-is-underperforming-6-8/244211 "2020-08-11T07:18:32Z")
Hello, I upgraded Elastic Stack from 6.8.2 to 7.6.2 (currently both clusters are running on EKS with kubernetes nodes on AWS m5.4xlarge machines 16CPUs 64GB - these are NOT SSDs) and I am experiencing degraded performan… --- ## [Is it possible to have an alias that points two multiple indexes with duplicate IDs with preference ordering?](https://discuss.elastic.co/t/is-it-possible-to-have-an-alias-that-points-two-multiple-indexes-with-duplicate-ids-with-preference-ordering/244480)
**Author:** [@jacobm](https://discuss.elastic.co/u/jacobm)\ **Replies:** 1\ **Last updated:** [August 11, 2020, 7:06am UTC](https://discuss.elastic.co/t/is-it-possible-to-have-an-alias-that-points-two-multiple-indexes-with-duplicate-ids-with-preference-ordering/244480 "2020-08-11T07:06:52Z")
My situation is: I have a big index (let's call it old) that allows search on documents that I derive from information in a relational database. I need to change the index mapping and add data to every document, and the … --- ## [Aggregate filter cache](https://discuss.elastic.co/t/aggregate-filter-cache/244432)
**Author:** [@kvtang](https://discuss.elastic.co/u/kvtang)\ **Replies:** 2\ **Last updated:** [August 11, 2020, 6:38am UTC](https://discuss.elastic.co/t/aggregate-filter-cache/244432 "2020-08-11T06:38:00Z")
Hi guys, If I'm using aggregate filter plugin, and after a start event, my collector node restarted for whatever reason. When my end event comes, is it able to find my start event? Is there any cache storing task\_id? T… --- ## [Logstash in the cloud](https://discuss.elastic.co/t/logstash-in-the-cloud/244492)
**Author:** [@mykael](https://discuss.elastic.co/u/mykael)\ **Replies:** 1\ **Last updated:** [August 11, 2020, 6:25am UTC](https://discuss.elastic.co/t/logstash-in-the-cloud/244492 "2020-08-11T06:25:24Z")
Am I right in thinking that if I want to use a customized logstash to ingest data into elastic search running under elastic cloud, then I need to get a separate cloud machine to run the logstash instance and connect it, … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1874) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1876)