# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1898 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1899 --- ## [Only one node in cluster(6 nodes) slow query and high read I/O when querying](https://discuss.elastic.co/t/only-one-node-in-cluster-6-nodes-slow-query-and-high-read-i-o-when-querying/243158)
**Author:** [@Sunghoon\_Jo](https://discuss.elastic.co/u/Sunghoon_Jo)\ **Replies:** 6\ **Last updated:** [July 30, 2020, 8:17am UTC](https://discuss.elastic.co/t/only-one-node-in-cluster-6-nodes-slow-query-and-high-read-i-o-when-querying/243158 "2020-07-30T08:17:23Z")
Hi All, I have some problem when querying. My cluster have 6 data nodes. When I query, only one node has unusual symptoms. my query is very simple. I'm doing stress tests, only one node shows high Read I/O(3000/s) , L… --- ## [Giving up on filebeat/elastic soon.. dashboards broken when rolling over index](https://discuss.elastic.co/t/giving-up-on-filebeat-elastic-soon-dashboards-broken-when-rolling-over-index/242869)
**Author:** [@Martin\_Norrsken](https://discuss.elastic.co/u/Martin_Norrsken)\ **Replies:** 9\ **Last updated:** [July 30, 2020, 8:04am UTC](https://discuss.elastic.co/t/giving-up-on-filebeat-elastic-soon-dashboards-broken-when-rolling-over-index/242869 "2020-07-30T08:04:29Z")
I've set up elastic stack (7.8.0 now 7.8.1) in kubernetes and filebeat on my nodes. Everty time an index rolls over i get a lot of broken stuff. Every time i try to customize anything it breaks... Its so much that i susp… --- ## [All index missing every 1-2 days. What is happening?](https://discuss.elastic.co/t/all-index-missing-every-1-2-days-what-is-happening/243152)
**Author:** [@Oh\_Chee\_Peng](https://discuss.elastic.co/u/Oh_Chee_Peng)\ **Replies:** 4\ **Last updated:** [July 30, 2020, 7:50am UTC](https://discuss.elastic.co/t/all-index-missing-every-1-2-days-what-is-happening/243152 "2020-07-30T07:50:13Z")
I created an instance on Google Cloud, using Elasticsearch Certified by Bitnami. There is no issue with creating index, but every 1 or 2 days, all index will be mysteriously missing, and I am having hard time troublesho… --- ## [Time-range search query help](https://discuss.elastic.co/t/time-range-search-query-help/243161)
**Author:** [@sandeepgdba](https://discuss.elastic.co/u/sandeepgdba)\ **Replies:** 1\ **Last updated:** [July 30, 2020, 7:47am UTC](https://discuss.elastic.co/t/time-range-search-query-help/243161 "2020-07-30T07:47:18Z")
Hi, I need help in time-range search aggregations, I am trying to figure out aggregated visits for every 2 hours below is the query which doesn't work. help needed on this POST index\_name/\_search { "size": 0, "quer… --- ## [Unable to authenticate elastic user when DR node is isolated from the elastic cluster](https://discuss.elastic.co/t/unable-to-authenticate-elastic-user-when-dr-node-is-isolated-from-the-elastic-cluster/243174)
**Author:** [@hiruni.insyncit.net](https://discuss.elastic.co/u/hiruni.insyncit.net)\ **Replies:** 1\ **Last updated:** [July 30, 2020, 7:44am UTC](https://discuss.elastic.co/t/unable-to-authenticate-elastic-user-when-dr-node-is-isolated-from-the-elastic-cluster/243174 "2020-07-30T07:44:32Z")
The elastic cluster consists of 5 primary nodes and 1 DR node. I was unable to authenticate the elastic cluster using elastic user(basic authentication). Also, I tried to curl -XGET -u elastic:password http://localhost… --- ## [Unable to import saved objects in Kibana](https://discuss.elastic.co/t/unable-to-import-saved-objects-in-kibana/243020)
**Author:** [@leo.hamon](https://discuss.elastic.co/u/leo.hamon)\ **Replies:** 7\ **Last updated:** [July 30, 2020, 7:42am UTC](https://discuss.elastic.co/t/unable-to-import-saved-objects-in-kibana/243020 "2020-07-30T07:42:56Z")
Hi all, I'm looking for some help to import saved objects on Kibana. I have about 75 visualizations and 10 dashboards on my computer and I want to export and import them in Kibana on a server. But when I drop my .ndjso… --- ## [Configuración de FileBeat](https://discuss.elastic.co/t/configuracion-de-filebeat/243138)
**Author:** [@jimmy.baldeond](https://discuss.elastic.co/u/jimmy.baldeond)\ **Replies:** 1\ **Last updated:** [July 30, 2020, 7:05am UTC](https://discuss.elastic.co/t/configuracion-de-filebeat/243138 "2020-07-30T07:05:23Z")
Hola, he instalado el Filebeat en el cluster de Kubernetes, sin embargo no visualizo los logs en el Kibana. Adicionalmente, les comento que los logs si llegan de los servidores normales. Sin embargo no funciona en Kubern… --- ## [Is there connector or plugin to pull or push nagios monitoring data to ELK?](https://discuss.elastic.co/t/is-there-connector-or-plugin-to-pull-or-push-nagios-monitoring-data-to-elk/243163)
**Author:** [@Jaya\_Nehru\_Kumar](https://discuss.elastic.co/u/Jaya_Nehru_Kumar)\ **Replies:** 0\ **Last updated:** [July 30, 2020, 6:46am UTC](https://discuss.elastic.co/t/is-there-connector-or-plugin-to-pull-or-push-nagios-monitoring-data-to-elk/243163 "2020-07-30T06:46:32Z")
is there connector or plugin to pull or push nagios monitoring data to ELK? --- ## [Filebeat Multiline Not Working At All, Please Help](https://discuss.elastic.co/t/filebeat-multiline-not-working-at-all-please-help/242537)
**Author:** [@gratefulted](https://discuss.elastic.co/u/gratefulted)\ **Replies:** 1\ **Last updated:** [July 30, 2020, 6:39am UTC](https://discuss.elastic.co/t/filebeat-multiline-not-working-at-all-please-help/242537 "2020-07-30T06:39:46Z")
Hi all, I'm fairly new to ELK stack and am helping a client with an issue they are having getting multiline logs formatted in kibana. Here is my filebeat.yml: #=========================== Filebeat inputs ==============… --- ## [Split a JSON array into individual documents in Logstash](https://discuss.elastic.co/t/split-a-json-array-into-individual-documents-in-logstash/243151)
**Author:** [@jclemons7](https://discuss.elastic.co/u/jclemons7)\ **Replies:** 7\ **Last updated:** [July 30, 2020, 6:29am UTC](https://discuss.elastic.co/t/split-a-json-array-into-individual-documents-in-logstash/243151 "2020-07-30T06:29:08Z")
I'm sorry to ask this honestly.. normally I'm a decently smart fella.. but I can't seem to grasp this. I have some JSON coming that I need to split into individual documents. { "lan": { "inkbps": 756.27034713779… --- ## [Multiple/Join query on same index](https://discuss.elastic.co/t/multiple-join-query-on-same-index/243160)
**Author:** [@mohitbharti](https://discuss.elastic.co/u/mohitbharti)\ **Replies:** 2\ **Last updated:** [July 30, 2020, 6:05am UTC](https://discuss.elastic.co/t/multiple-join-query-on-same-index/243160 "2020-07-30T06:05:53Z")
I want to know the Elastic search query for select \* from (Select sum(income) from users where users.name like '%abc%' group by users.address) aResult, (select count(\*), phone number from users where users.name like '%… --- ## [Dynamic lookup on Kibana](https://discuss.elastic.co/t/dynamic-lookup-on-kibana/242524)
**Author:** [@zfmoto](https://discuss.elastic.co/u/zfmoto)\ **Replies:** 2\ **Last updated:** [July 30, 2020, 6:13am UTC](https://discuss.elastic.co/t/dynamic-lookup-on-kibana/242524 "2020-07-30T06:13:47Z")
Currently, I'm trying to associate a process ID from a log to the name of the process. For instance, if I ingest 5 files, all of which belong to the same device, the name of the process will have a different process ID. … --- ## [Bug in bulk requests with mix of requests with and without pipelines](https://discuss.elastic.co/t/bug-in-bulk-requests-with-mix-of-requests-with-and-without-pipelines/242973)
**Author:** [@sihtam23](https://discuss.elastic.co/u/sihtam23)\ **Replies:** 2\ **Last updated:** [July 30, 2020, 5:53am UTC](https://discuss.elastic.co/t/bug-in-bulk-requests-with-mix-of-requests-with-and-without-pipelines/242973 "2020-07-30T05:53:11Z")
I'm new here but not new to using the Elastic stack; I apologise if I get reporting this bug wrong. This bug exists in Elasticsearch 7.8. I know it doesn't exist in 6.8 but I haven't looked at all the in-between version… --- ## [Rollover Automation with ILM](https://discuss.elastic.co/t/rollover-automation-with-ilm/243112)
**Author:** [@hemanth49841](https://discuss.elastic.co/u/hemanth49841)\ **Replies:** 2\ **Last updated:** [July 30, 2020, 5:51am UTC](https://discuss.elastic.co/t/rollover-automation-with-ilm/243112 "2020-07-30T05:51:41Z")
Hi All, I have face a issue with indices rollover automation with ILM. Created ILM policy with rollover Max index size is 1GB. But rollover is happening at 1.2 GB. almost 0.2 GB lag is there. Also, changed the Cluster… --- ## [Ansible Elasticsearch Hangs on TASK \[elastic.elasticsearch : Wait for elasticsearch to startup\]](https://discuss.elastic.co/t/ansible-elasticsearch-hangs-on-task-elastic-elasticsearch-wait-for-elasticsearch-to-startup/241734)
**Author:** [@M\_M](https://discuss.elastic.co/u/M_M)\ **Replies:** 2\ **Last updated:** [July 30, 2020, 5:04am UTC](https://discuss.elastic.co/t/ansible-elasticsearch-hangs-on-task-elastic-elasticsearch-wait-for-elasticsearch-to-startup/241734 "2020-07-30T05:04:06Z")
The elasticsearch initiates successfully on the nodes but somehow ansible is stuck at TASK \[elastic.elasticsearch : Wait for elasticsearch to startup\] My nodes are EC2 Amazon linux 2 and ansible is run from my desktop… --- ## [Table Visual with Top Hit and filtering](https://discuss.elastic.co/t/table-visual-with-top-hit-and-filtering/243155)
**Author:** [@analog\_memories](https://discuss.elastic.co/u/analog_memories)\ **Replies:** 0\ **Last updated:** [July 30, 2020, 4:32am UTC](https://discuss.elastic.co/t/table-visual-with-top-hit-and-filtering/243155 "2020-07-30T04:32:36Z")
Hello there. I have a table visual that I have 2 Top Hits aggs. This is for Metricbeat filesystem used, trying to see when a host breaks a threshold. The Top Hits are for when the host is first seen in the query resul… --- ## [Best method in fingerprint](https://discuss.elastic.co/t/best-method-in-fingerprint/243055)
**Author:** [@Saravana37](https://discuss.elastic.co/u/Saravana37)\ **Replies:** 3\ **Last updated:** [July 30, 2020, 4:32am UTC](https://discuss.elastic.co/t/best-method-in-fingerprint/243055 "2020-07-30T04:32:24Z")
Hello All , Can any one please let me know which is the best method used in Fingerprint filter ? I am beginner in fingerprint filter and not able to figure-out . Thanks and Regards Saravana S --- ## [Elastic Search REST api version dependency](https://discuss.elastic.co/t/elastic-search-rest-api-version-dependency/243134)
**Author:** [@Musfiqur\_Siddique](https://discuss.elastic.co/u/Musfiqur_Siddique)\ **Replies:** 1\ **Last updated:** [July 30, 2020, 2:42am UTC](https://discuss.elastic.co/t/elastic-search-rest-api-version-dependency/243134 "2020-07-30T02:42:26Z")
I see that there is a lot of similarities among different ES Highlevel REST versions in terms the api signature and data models https://www.elastic.co/guide/en/elasticsearch/client/java-rest/current/java-rest-high.html.… --- ## [Automatically created templates break beats dashboards](https://discuss.elastic.co/t/automatically-created-templates-break-beats-dashboards/242831)
**Author:** [@jclemons7](https://discuss.elastic.co/u/jclemons7)\ **Replies:** 2\ **Last updated:** [July 30, 2020, 12:54am UTC](https://discuss.elastic.co/t/automatically-created-templates-break-beats-dashboards/242831 "2020-07-30T00:54:52Z")
Hello, I'm hoping someone can help me get this straight in my head. I've setup elastic stack all on one server and everything works well as it is. I've been messing with the beats in my lab (Winlogbeat, Packetbeat, Me… --- ## [We want to automatically delete some document with different expiration dates](https://discuss.elastic.co/t/we-want-to-automatically-delete-some-document-with-different-expiration-dates/243000)
**Author:** [@devin.teki](https://discuss.elastic.co/u/devin.teki)\ **Replies:** 7\ **Last updated:** [July 30, 2020, 12:54am UTC](https://discuss.elastic.co/t/we-want-to-automatically-delete-some-document-with-different-expiration-dates/243000 "2020-07-30T00:54:32Z")
How to let elasticsearch5.5.2 automatic delete document by some datetime field. The \_ttl mappings have been removed from 5.x. because effifient problem. Is there any other way I can delete expired files automatically… --- ## [Filebeat output elasticsearch pipeline not working](https://discuss.elastic.co/t/filebeat-output-elasticsearch-pipeline-not-working/240167)
**Author:** [@bernhard.fluehmann](https://discuss.elastic.co/u/bernhard.fluehmann)\ **Replies:** 5\ **Last updated:** [July 30, 2020, 12:08am UTC](https://discuss.elastic.co/t/filebeat-output-elasticsearch-pipeline-not-working/240167 "2020-07-30T00:08:09Z")
Hi, I am stuck on configuring filebeat to use a custom elasticsearch ingest pipeline. For some reasons the pipeline is now applied for logs shipped by filebeat. If a document is indexed manually, everything works as e… --- ## [Elasticsearch using too much memory](https://discuss.elastic.co/t/elasticsearch-using-too-much-memory/242808)
**Author:** [@SteveHodges](https://discuss.elastic.co/u/SteveHodges)\ **Replies:** 9\ **Last updated:** [July 29, 2020, 11:08pm UTC](https://discuss.elastic.co/t/elasticsearch-using-too-much-memory/242808 "2020-07-29T23:08:12Z")
Hello, Originally the ELK stack was working great but after several months of collecting logs, Kibana reports are failing to run properly and it appears due to Elasticsearch memory issues. At least for the past week th… --- ## [I have loaded some logs onto Kibana through logstash but not able to visualize it. Please help](https://discuss.elastic.co/t/i-have-loaded-some-logs-onto-kibana-through-logstash-but-not-able-to-visualize-it-please-help/243127)
**Author:** [@ishan.abhinit](https://discuss.elastic.co/u/ishan.abhinit)\ **Replies:** 6\ **Last updated:** [July 29, 2020, 10:51pm UTC](https://discuss.elastic.co/t/i-have-loaded-some-logs-onto-kibana-through-logstash-but-not-able-to-visualize-it-please-help/243127 "2020-07-29T22:51:30Z")
I have loaded some logs onto Kibana through logstash but not able to visualize it. Please help. !\[image|690x255\](upload://iphkLDgNMjPf5ckQWnShHvvXJKW.png) When i click on the available field on the left pane, it does … --- ## [Access Kibana 7.8 outside of LAN](https://discuss.elastic.co/t/access-kibana-7-8-outside-of-lan/242352)
**Author:** [@prophoto](https://discuss.elastic.co/u/prophoto)\ **Replies:** 4\ **Last updated:** [July 29, 2020, 10:45pm UTC](https://discuss.elastic.co/t/access-kibana-7-8-outside-of-lan/242352 "2020-07-29T22:45:50Z")
My web servers running CentOS 7 are on AWS. I am running Elasticsearch and Kibana on a local VM also running CentOS 7 and what logs shipped there. Logs are flowing fine to Elasticsearch from the remote web servers. Unfo… --- ## [Kibana Graph KQL not being followed](https://discuss.elastic.co/t/kibana-graph-kql-not-being-followed/242096)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 7\ **Last updated:** [July 29, 2020, 10:25pm UTC](https://discuss.elastic.co/t/kibana-graph-kql-not-being-followed/242096 "2020-07-29T22:25:00Z")
I'm testing out the Kibana Graph feature and am running into an issue. I would expect the KQL field to limit the search, however, it appears that this doesn't happen. Anyone know why? Example below, I would not expect t… --- ## [Using credentials manager to store Logstash's keystore password](https://discuss.elastic.co/t/using-credentials-manager-to-store-logstashs-keystore-password/243131)
**Author:** [@GusAntoniassi](https://discuss.elastic.co/u/GusAntoniassi)\ **Replies:** 0\ **Last updated:** [July 29, 2020, 9:43pm UTC](https://discuss.elastic.co/t/using-credentials-manager-to-store-logstashs-keystore-password/243131 "2020-07-29T21:43:49Z")
Hello! I am currently using Logstash 7.8.0, running as a service and installed via package manager (yum) on an Amazon Linux OS. I am the Logstash Keystore to store some sensitive credentials used by my pipelines. I man… --- ## [Timelion - change X axis to reflect ingest times](https://discuss.elastic.co/t/timelion-change-x-axis-to-reflect-ingest-times/242996)
**Author:** [@Scott\_B](https://discuss.elastic.co/u/Scott_B)\ **Replies:** 5\ **Last updated:** [July 29, 2020, 9:43pm UTC](https://discuss.elastic.co/t/timelion-change-x-axis-to-reflect-ingest-times/242996 "2020-07-29T21:43:40Z")
I would like to change the X axis in Timelion to show a spike for each ingest time of data, not for set time intervals. The ingest times might be 5 minutes apart or days apart. When using set time intervals the ingests t… --- ## [Single Kibana for multi ES clusters](https://discuss.elastic.co/t/single-kibana-for-multi-es-clusters/243102)
**Author:** [@deeshu](https://discuss.elastic.co/u/deeshu)\ **Replies:** 1\ **Last updated:** [July 29, 2020, 9:41pm UTC](https://discuss.elastic.co/t/single-kibana-for-multi-es-clusters/243102 "2020-07-29T21:41:10Z")
Hi, Can we add multiple elasticsearch clusters in kibana.yml? like below elasticsearch.hosts: https://cluster1.xyz.com:9200, https://cluster2.xyz.com:9200 So the objective here is to have single kibana url and console… --- ## [Does in refresh interval data of the entire shards get changed](https://discuss.elastic.co/t/does-in-refresh-interval-data-of-the-entire-shards-get-changed/242886)
**Author:** [@rishabh\_jain](https://discuss.elastic.co/u/rishabh_jain)\ **Replies:** 5\ **Last updated:** [July 29, 2020, 9:39pm UTC](https://discuss.elastic.co/t/does-in-refresh-interval-data-of-the-entire-shards-get-changed/242886 "2020-07-29T21:39:46Z")
Does in refresh interval data of the entire shards get changed or only the data which has been changed. Suppose refresh interval is 1s. And in if index.requests.cache.enable = true then filter query results will be c… --- ## [Enable Index after disabling it](https://discuss.elastic.co/t/enable-index-after-disabling-it/242803)
**Author:** [@animageofmine](https://discuss.elastic.co/u/animageofmine)\ **Replies:** 2\ **Last updated:** [July 29, 2020, 9:29pm UTC](https://discuss.elastic.co/t/enable-index-after-disabling-it/242803 "2020-07-29T21:29:43Z")
Index attribute enables / disables indexing on elasticsearch. I am wondering if I can do the following: Disable indexing (set index to false) on a field. At some point in future, enable indexing on that field. This is… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1897) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1899)