# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1889 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1890 --- ## [Is it necessary to upgrade?](https://discuss.elastic.co/t/is-it-necessary-to-upgrade/243668)
**Author:** [@Benjamin\_Gathmann](https://discuss.elastic.co/u/Benjamin_Gathmann)\ **Replies:** 3\ **Last updated:** [August 4, 2020, 8:53am UTC](https://discuss.elastic.co/t/is-it-necessary-to-upgrade/243668 "2020-08-04T08:53:31Z")
We are running Elasticsearch v2.4 and are still happy with it. Are there any reasons to upgrade besides new features and performance improvements? E.g. are there any security issues with the 2.x branch? I could not fin… --- ## [How to group unique statistics records with overlapping fields (account and fingerprint)?](https://discuss.elastic.co/t/how-to-group-unique-statistics-records-with-overlapping-fields-account-and-fingerprint/243667)
**Author:** [@ange007](https://discuss.elastic.co/u/ange007)\ **Replies:** 0\ **Last updated:** [August 4, 2020, 8:01am UTC](https://discuss.elastic.co/t/how-to-group-unique-statistics-records-with-overlapping-fields-account-and-fingerprint/243667 "2020-08-04T08:01:45Z")
Hi. There is an index with fields: account\_id fingerprint etc. Each record may or may not have an account\_id , the same is with fingerprint . It is necessary to group them by account\_id along the way adding to th… --- ## [How To search on all the Ids in a Index in TermLookUp Mechanism](https://discuss.elastic.co/t/how-to-search-on-all-the-ids-in-a-index-in-termlookup-mechanism/243658)
**Author:** [@kashifa](https://discuss.elastic.co/u/kashifa)\ **Replies:** 0\ **Last updated:** [August 4, 2020, 7:23am UTC](https://discuss.elastic.co/t/how-to-search-on-all-the-ids-in-a-index-in-termlookup-mechanism/243658 "2020-08-04T07:23:14Z")
I have two indices namely "School" and "Student" and I have to join these two indices based on some criteria and populate the results. Let me state the example scenario here. School Data Example: { "resourceT… --- ## [Docker registry layer metadata correct?](https://discuss.elastic.co/t/docker-registry-layer-metadata-correct/243655)
**Author:** [@Just-Ross](https://discuss.elastic.co/u/Just-Ross)\ **Replies:** 0\ **Last updated:** [August 4, 2020, 6:45am UTC](https://discuss.elastic.co/t/docker-registry-layer-metadata-correct/243655 "2020-08-04T06:45:56Z")
Can someone offer advice here please - when querying docker.elastic.co for image layers (any 2+ schema) the results are totally different to a 3rd party registry for the identical image (e.g. AWS ECR): Authenticate to … --- ## [Elasticsearch-service on windows 10 not starting (es.path.conf not set)](https://discuss.elastic.co/t/elasticsearch-service-on-windows-10-not-starting-es-path-conf-not-set/243172)
**Author:** [@feva](https://discuss.elastic.co/u/feva)\ **Replies:** 1\ **Last updated:** [August 4, 2020, 6:33am UTC](https://discuss.elastic.co/t/elasticsearch-service-on-windows-10-not-starting-es-path-conf-not-set/243172 "2020-08-04T06:33:24Z")
I have some troubles installing elasticsearch as a service. I am working on Windows 10 with elasticsearch-7.8.0 The log files say Failed to start service 2020-07-30 08:50:17 Commons Daemon procrun stderr initialized … --- ## [How to Filter nested aggregations (busket results)](https://discuss.elastic.co/t/how-to-filter-nested-aggregations-busket-results/243190)
**Author:** [@aakhiezer](https://discuss.elastic.co/u/aakhiezer)\ **Replies:** 2\ **Last updated:** [August 4, 2020, 6:23am UTC](https://discuss.elastic.co/t/how-to-filter-nested-aggregations-busket-results/243190 "2020-08-04T06:23:22Z")
Hi all, I'm trying to filter an aggregations. I created aggregation for nested fields(pipe of id|value) of Badge field. It works good and return me buskets with pipe and doc\_count. But I want to filter them to return m… --- ## [Warning regarding jvm option UseConcMarkSweepGC was deprecated](https://discuss.elastic.co/t/warning-regarding-jvm-option-useconcmarksweepgc-was-deprecated/241398)
**Author:** [@pratiksha](https://discuss.elastic.co/u/pratiksha)\ **Replies:** 5\ **Last updated:** [August 4, 2020, 6:10am UTC](https://discuss.elastic.co/t/warning-regarding-jvm-option-useconcmarksweepgc-was-deprecated/241398 "2020-08-04T06:10:21Z")
Hi, We are currently on elasticsearch version 7.0.1 and about to upgrade to 7.8. In our elastic search logs, we observe a warning "OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version … --- ## [Logstash if conditions connected with and](https://discuss.elastic.co/t/logstash-if-conditions-connected-with-and/243199)
**Author:** [@Souji\_T](https://discuss.elastic.co/u/Souji_T)\ **Replies:** 8\ **Last updated:** [August 4, 2020, 6:08am UTC](https://discuss.elastic.co/t/logstash-if-conditions-connected-with-and/243199 "2020-08-04T06:08:02Z")
Hello, I am trying to add a field with logstash. For example, I have following line in the filter section of my config file from logstash: if \[dest\_ip\] == "194.175.245.9" and \[alert\]\[signature\_id\] == "2009702" { … --- ## [Repair index after too many open files error](https://discuss.elastic.co/t/repair-index-after-too-many-open-files-error/243542)
**Author:** [@hunsw](https://discuss.elastic.co/u/hunsw)\ **Replies:** 1\ **Last updated:** [August 4, 2020, 5:41am UTC](https://discuss.elastic.co/t/repair-index-after-too-many-open-files-error/243542 "2020-08-04T05:41:30Z")
We had 'too many open files' error on several nodes and even though we fixed the problem, one shard fell into a sort of a limbo. # Relevant \_cluster/allocation/explain output: node01.example.com = {"in\_sync":true,"alloc… --- ## [I deleted the elasticsearch folder in /etc/elasticsearch/ , not sure how to restore back?](https://discuss.elastic.co/t/i-deleted-the-elasticsearch-folder-in-etc-elasticsearch-not-sure-how-to-restore-back/243585)
**Author:** [@Athiq\_Ahmed](https://discuss.elastic.co/u/Athiq_Ahmed)\ **Replies:** 3\ **Last updated:** [August 4, 2020, 5:33am UTC](https://discuss.elastic.co/t/i-deleted-the-elasticsearch-folder-in-etc-elasticsearch-not-sure-how-to-restore-back/243585 "2020-08-04T05:33:21Z")
I have built the Flask application(Python) which is linked to Elasticsearch(port:9200), Now I need to deploy this application within AWS EC2, however while performing I deleted the Elasticsearch folder within /etc and no… --- ## [Does Elasticsearch automatically compress indexes?](https://discuss.elastic.co/t/does-elasticsearch-automatically-compress-indexes/243354)
**Author:** [@d.silwon](https://discuss.elastic.co/u/d.silwon)\ **Replies:** 5\ **Last updated:** [August 4, 2020, 5:27am UTC](https://discuss.elastic.co/t/does-elasticsearch-automatically-compress-indexes/243354 "2020-08-04T05:27:23Z")
Dears, We have ELK in version 7.7.1. Everyday we send to ELK logs is size about 30GB. I'm worried about FS space. My question is does Elasticsearch automatically compress indexes? or Should it be forced with the corr… --- ## [How to export csv when \_source is disabled](https://discuss.elastic.co/t/how-to-export-csv-when-source-is-disabled/243150)
**Author:** [@t98907](https://discuss.elastic.co/u/t98907)\ **Replies:** 2\ **Last updated:** [August 4, 2020, 4:38am UTC](https://discuss.elastic.co/t/how-to-export-csv-when-source-is-disabled/243150 "2020-08-04T04:38:40Z")
Hi there, I looked into the reason why kibana can't export csv. It was because I had \_source disabled in my index, so I couldn't export csv with kibana. But I'm storing the fields I need, and discover is outputting th… --- ## [Kibana Stack Monitoring Elasticsearch JVM Heap is not changing](https://discuss.elastic.co/t/kibana-stack-monitoring-elasticsearch-jvm-heap-is-not-changing/243494)
**Author:** [@evacch](https://discuss.elastic.co/u/evacch)\ **Replies:** 3\ **Last updated:** [August 4, 2020, 4:04am UTC](https://discuss.elastic.co/t/kibana-stack-monitoring-elasticsearch-jvm-heap-is-not-changing/243494 "2020-08-04T04:04:21Z")
I have changed the jvm.options of my Elasticsearch yml file to min 3GB and max 3GB as shown below to retrieve the heap status. However, the JVM heap in Elasticsearch in Kibana Stack Monitoring is not updated and it's … --- ## [Sample Dashboard isnt working](https://discuss.elastic.co/t/sample-dashboard-isnt-working/243642)
**Author:** [@samoffice](https://discuss.elastic.co/u/samoffice)\ **Replies:** 1\ **Last updated:** [August 4, 2020, 3:19am UTC](https://discuss.elastic.co/t/sample-dashboard-isnt-working/243642 "2020-08-04T03:19:58Z")
Trying to create a build a sample dashboard based on this sample given: https://www.elastic.co/guide/en/kibana/current/tutorial-build-dashboard.html Facing following errors: Trying to set mappings as below: PUT /shak… --- ## [Why filebeat collected multi pod log to single row？](https://discuss.elastic.co/t/why-filebeat-collected-multi-pod-log-to-single-row/243641)
**Author:** [@lklkxcxc](https://discuss.elastic.co/u/lklkxcxc)\ **Replies:** 0\ **Last updated:** [August 4, 2020, 3:09am UTC](https://discuss.elastic.co/t/why-filebeat-collected-multi-pod-log-to-single-row/243641 "2020-08-04T03:09:00Z")
There are three containers in single row ，please check ” kubernetes.container.name “ --- ## [Aggregation Filter 2 logs same index](https://discuss.elastic.co/t/aggregation-filter-2-logs-same-index/243624)
**Author:** [@rcavezzale](https://discuss.elastic.co/u/rcavezzale)\ **Replies:** 11\ **Last updated:** [August 4, 2020, 1:38am UTC](https://discuss.elastic.co/t/aggregation-filter-2-logs-same-index/243624 "2020-08-04T01:38:18Z")
Dear Comminuty I need your help to fix my issue. i have 2 logs in same index that should be aggregate to view all information on the Data Table visualize input { udp { port =\> 1514 type =\> "alcatel" } } filter { if \[… --- ## [Kibana Datatable - Filters and Url links](https://discuss.elastic.co/t/kibana-datatable-filters-and-url-links/243487)
**Author:** [@nshrestha](https://discuss.elastic.co/u/nshrestha)\ **Replies:** 4\ **Last updated:** [August 4, 2020, 12:08am UTC](https://discuss.elastic.co/t/kibana-datatable-filters-and-url-links/243487 "2020-08-04T00:08:12Z")
Hi, Am creating a Datatable in Kibana. Have edited a field format as Url and supplied the relevant link in Url template. It is working as expected when I click on the field. But when I use filters on that field in datat… --- ## [Heartbeat log file is not created](https://discuss.elastic.co/t/heartbeat-log-file-is-not-created/243310)
**Author:** [@AClerk](https://discuss.elastic.co/u/AClerk)\ **Replies:** 5\ **Last updated:** [August 4, 2020, 12:04am UTC](https://discuss.elastic.co/t/heartbeat-log-file-is-not-created/243310 "2020-08-04T00:04:41Z")
Very basic, but... The log file is not created. Any ideas? logging.level: debug logging.to\_files: true logging.files: path: /var/log/heartbeat name: heartbeat.log keepfiles: 3 permissions: 0644 Copied from - h… --- ## [Invalid NEST response built from a unsuccessful (401) low level call on HEAD: /](https://discuss.elastic.co/t/invalid-nest-response-built-from-a-unsuccessful-401-low-level-call-on-head/243537)
**Author:** [@buka\_bidzina](https://discuss.elastic.co/u/buka_bidzina)\ **Replies:** 1\ **Last updated:** [August 3, 2020, 11:37pm UTC](https://discuss.elastic.co/t/invalid-nest-response-built-from-a-unsuccessful-401-low-level-call-on-head/243537 "2020-08-03T23:37:01Z")
Invalid NEST response built from a unsuccessful (401) low level call on HEAD: / Audit trail of this API call: \[1\] BadResponse: Node: http://es.test.dev/ Exception: PipelineException Took: 00:00:00.1126819 OriginalExce… --- ## [Connect to ElasticSearch through a wrapper](https://discuss.elastic.co/t/connect-to-elasticsearch-through-a-wrapper/242876)
**Author:** [@itsbalur](https://discuss.elastic.co/u/itsbalur)\ **Replies:** 1\ **Last updated:** [August 3, 2020, 11:33pm UTC](https://discuss.elastic.co/t/connect-to-elasticsearch-through-a-wrapper/242876 "2020-08-03T23:33:38Z")
We use NEST API version 7.4 to connect to ES cluster with four nodes running v 7.4 The connection settings are as follows var nodeUrls = "url1~url2~url3~url4".Split('~').Select(u =\> new Uri(u)); var nodes = nod… --- ## [Security tab not display under Stack Management after security setup](https://discuss.elastic.co/t/security-tab-not-display-under-stack-management-after-security-setup/243418)
**Author:** [@aaristotle](https://discuss.elastic.co/u/aaristotle)\ **Replies:** 6\ **Last updated:** [August 3, 2020, 11:01pm UTC](https://discuss.elastic.co/t/security-tab-not-display-under-stack-management-after-security-setup/243418 "2020-08-03T23:01:22Z")
Hello, I am new to Elastic Stack, i have setup security in version 7.7.1 of Eleasticsearch and Kibana, but recently i did that in version 7.8.1 but i can't see the security tab that use to be under stack management in th… --- ## [RestHighLevelClient re-connect on connection reset](https://discuss.elastic.co/t/resthighlevelclient-re-connect-on-connection-reset/243203)
**Author:** [@gitterhh](https://discuss.elastic.co/u/gitterhh)\ **Replies:** 0\ **Last updated:** [July 30, 2020, 10:32am UTC](https://discuss.elastic.co/t/resthighlevelclient-re-connect-on-connection-reset/243203 "2020-07-30T10:32:03Z")
I am using Spring + RestHighLevelClient to send data to Elasticsearch restHighLevelClient.search(searchRequest, RequestOptions.DEFAULT) But when the system has been idle for a while, the following exception is thrown j… --- ## [DEFAULT\_MAX\_CONN\_TOTAL value in RestClientBuilder](https://discuss.elastic.co/t/default-max-conn-total-value-in-restclientbuilder/243219)
**Author:** [@Shubham\_Mittal](https://discuss.elastic.co/u/Shubham_Mittal)\ **Replies:** 0\ **Last updated:** [July 30, 2020, 12:48pm UTC](https://discuss.elastic.co/t/default-max-conn-total-value-in-restclientbuilder/243219 "2020-07-30T12:48:44Z")
Hi , Please suggest if DEFAULT\_MAX\_CONN\_TOTAL value ie. 30 should be increased while initializing the client , if there is a use case for more than 100 like upto 500 elasticsearch concurrent requests using 1 client with… --- ## [Check Point Filebeat module clarification](https://discuss.elastic.co/t/check-point-filebeat-module-clarification/243360)
**Author:** [@jasonwomack](https://discuss.elastic.co/u/jasonwomack)\ **Replies:** 0\ **Last updated:** [July 31, 2020, 1:52pm UTC](https://discuss.elastic.co/t/check-point-filebeat-module-clarification/243360 "2020-07-31T13:52:51Z")
I’m hoping someone can clarify how Filebeat is supposed to be setup when being used to process logs from a Check Point firewall (as covered here: https://www.elastic.co/guide/en/beats/filebeat/master/filebeat-module-chec… --- ## [Secure auditbeat output](https://discuss.elastic.co/t/secure-auditbeat-output/243448)
**Author:** [@elk6](https://discuss.elastic.co/u/elk6)\ **Replies:** 1\ **Last updated:** [August 3, 2020, 10:22pm UTC](https://discuss.elastic.co/t/secure-auditbeat-output/243448 "2020-08-03T22:22:46Z")
I have logstash listening for encrypted data. If I set auditbeat output to logstash with ssl, I won't find the data later in elasticsearch. If I set auditbeat output to elasticsearch, I can't get it to encrypt data. Thi… --- ## [Need help with Index Lifecycle Policy](https://discuss.elastic.co/t/need-help-with-index-lifecycle-policy/243391)
**Author:** [@uklipse](https://discuss.elastic.co/u/uklipse)\ **Replies:** 0\ **Last updated:** [July 31, 2020, 7:24pm UTC](https://discuss.elastic.co/t/need-help-with-index-lifecycle-policy/243391 "2020-07-31T19:24:55Z")
I'm trying to create a Index Lifecycle Policy but it's not rolling over. I've got the policy created to rollover at a certain size and it's linked to my index. I setup the index name of dns-7.6.2-000001 and gave it an al… --- ## [Exabeam integration with winlogbeat](https://discuss.elastic.co/t/exabeam-integration-with-winlogbeat/243395)
**Author:** [@elastic.newb](https://discuss.elastic.co/u/elastic.newb)\ **Replies:** 1\ **Last updated:** [August 3, 2020, 10:20pm UTC](https://discuss.elastic.co/t/exabeam-integration-with-winlogbeat/243395 "2020-08-03T22:20:37Z")
I am realatively new to the elastic environment and I am hoping that someone might be able to point me to a walkthrough or steps on collecting events for windows and sending them to exabeam. Thanks! --- ## [Auditbeat encryption and dashboards](https://discuss.elastic.co/t/auditbeat-encryption-and-dashboards/243423)
**Author:** [@elk6](https://discuss.elastic.co/u/elk6)\ **Replies:** 0\ **Last updated:** [August 1, 2020, 12:40pm UTC](https://discuss.elastic.co/t/auditbeat-encryption-and-dashboards/243423 "2020-08-01T12:40:16Z")
I'm a little overwhelmed and I was hoping someone could help me sort things out. On each machine, I have auditbeat setup. On top of the audit logs, I also use auditbeat for the dashboards it provides in kibana (for fail… --- ## [Event ID missing - winlogbeat](https://discuss.elastic.co/t/event-id-missing-winlogbeat/243479)
**Author:** [@edvrfn](https://discuss.elastic.co/u/edvrfn)\ **Replies:** 0\ **Last updated:** [August 2, 2020, 8:21pm UTC](https://discuss.elastic.co/t/event-id-missing-winlogbeat/243479 "2020-08-02T20:21:18Z")
I am interested in event-id 3 of sysmon and and i am not getting it in elasticsearch. There are other event IDs but not this one. Blockquote Network connection detected: RuleName: - UtcTime: 2020-08-02 19:46:15.226 … --- ## [Kibana server is not ready yet](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/243515)
**Author:** [@headtea](https://discuss.elastic.co/u/headtea)\ **Replies:** 1\ **Last updated:** [August 3, 2020, 10:13pm UTC](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/243515 "2020-08-03T22:13:04Z")
As an attempt to secure communications from beats to elasticsearch, I've followed this "Securing ES with HTTP" part of the guide and as part 4 says, I've followed the readme for kibana by adding these lines to kibana.yml … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1888) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1890)