# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1907 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1908 --- ## [Filebeat s3 cannot parse jsonl file who's content-type is set to application/json](https://discuss.elastic.co/t/filebeat-s3-cannot-parse-jsonl-file-whos-content-type-is-set-to-application-json/239374)
**Author:** [@lag13](https://discuss.elastic.co/u/lag13)\ **Replies:** 3\ **Last updated:** [July 24, 2020, 9:24pm UTC](https://discuss.elastic.co/t/filebeat-s3-cannot-parse-jsonl-file-whos-content-type-is-set-to-application-json/239374 "2020-07-24T21:24:42Z")
Hello! I was hoping y'all could help me out. The essence of my problem is that the filebeat S3 input plugin cannot process an s3 object who's content-type is application/json AND the object content is a separate json ob… --- ## [How do I increase the size of the displayed bar?](https://discuss.elastic.co/t/how-do-i-increase-the-size-of-the-displayed-bar/242315)
**Author:** [@menes](https://discuss.elastic.co/u/menes)\ **Replies:** 1\ **Last updated:** [July 24, 2020, 9:20pm UTC](https://discuss.elastic.co/t/how-do-i-increase-the-size-of-the-displayed-bar/242315 "2020-07-24T21:20:54Z")
Good afternoon. When the bar graph is removed, It turns into a line, but this does not happen when using Line points. Is there any way around this problem? --- ## [Delete indices older than 30 days using Kibana Index Lifecycle policies](https://discuss.elastic.co/t/delete-indices-older-than-30-days-using-kibana-index-lifecycle-policies/242350)
**Author:** [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Replies:** 6\ **Last updated:** [July 24, 2020, 7:44pm UTC](https://discuss.elastic.co/t/delete-indices-older-than-30-days-using-kibana-index-lifecycle-policies/242350 "2020-07-24T19:44:34Z")
Hello. I am new to ELK. I have managed to install and setup ELK 7.6.2 stack on RHEL 7 servers. Now as part of house keeping I need to remove/ delete indices older than 30 days to maintain certain level of available dis… --- ## [Performance Benefits to using Stored Scripts?](https://discuss.elastic.co/t/performance-benefits-to-using-stored-scripts/242556)
**Author:** [@micah.williamson](https://discuss.elastic.co/u/micah.williamson)\ **Replies:** 1\ **Last updated:** [July 24, 2020, 7:29pm UTC](https://discuss.elastic.co/t/performance-benefits-to-using-stored-scripts/242556 "2020-07-24T19:29:40Z")
I haven't seen anything in the documentation that would suggest using stored scripts are better for performance, but intuitively I'd think running a stored script many times would perform better than running an inline sc… --- ## [Which synonym match led to the retrieved result document?](https://discuss.elastic.co/t/which-synonym-match-led-to-the-retrieved-result-document/242557)
**Author:** [@lancy](https://discuss.elastic.co/u/lancy)\ **Replies:** 0\ **Last updated:** [July 24, 2020, 6:20pm UTC](https://discuss.elastic.co/t/which-synonym-match-led-to-the-retrieved-result-document/242557 "2020-07-24T18:20:48Z")
When we query an index configured with query-time expansion format synonyms (e.g.: specimen, sample, exemplar) is it possible to determine which particular synonym or synonym set led to a document being retrieved as a re… --- ## [Filebeat 7.7 panw module sends THREAT, but not TRAFFIC logs](https://discuss.elastic.co/t/filebeat-7-7-panw-module-sends-threat-but-not-traffic-logs/239792)
**Author:** [@nverrill](https://discuss.elastic.co/u/nverrill)\ **Replies:** 7\ **Last updated:** [July 24, 2020, 6:13pm UTC](https://discuss.elastic.co/t/filebeat-7-7-panw-module-sends-threat-but-not-traffic-logs/239792 "2020-07-24T18:13:17Z")
I am testing Filebeat 7.7 with the panw module, and am receiving THREAT type logs, but not TRAFFIC type logs. Elasticsearch version is also 7.7. filebeat.yml config: filebeat.config.modules: path: ${path.config}/modu… --- ## [Docker-elk\_logstash\_1 exited with code 1 after enabling xpack.security](https://discuss.elastic.co/t/docker-elk-logstash-1-exited-with-code-1-after-enabling-xpack-security/242554)
**Author:** [@Bhanu\_Praveen](https://discuss.elastic.co/u/Bhanu_Praveen)\ **Replies:** 0\ **Last updated:** [July 24, 2020, 6:08pm UTC](https://discuss.elastic.co/t/docker-elk-logstash-1-exited-with-code-1-after-enabling-xpack-security/242554 "2020-07-24T18:08:33Z")
Hello, I set-up docker image in production server with single node. Stack came up and working fine. As a part of next step, enabled "xpack.security.enabled: true" in elasticsearch.yml. Generated random passwords for bui… --- ## [Dockerized Kibana not able to connect to elasticsearch nodes, unable to retrieve connection](https://discuss.elastic.co/t/dockerized-kibana-not-able-to-connect-to-elasticsearch-nodes-unable-to-retrieve-connection/241576)
**Author:** [@Bhanu\_Praveen](https://discuss.elastic.co/u/Bhanu_Praveen)\ **Replies:** 10\ **Last updated:** [July 24, 2020, 6:02pm UTC](https://discuss.elastic.co/t/dockerized-kibana-not-able-to-connect-to-elasticsearch-nodes-unable-to-retrieve-connection/241576 "2020-07-24T18:02:43Z")
Hello, I am having a complete elastic stack in docker and below is my docker-compose.yml. version: '3.2' services: elasticsearch: build: context: elasticsearch/ args: ELK\_VERSION: $ELK\_VERSIO… --- ## [Logstash https plugin not working](https://discuss.elastic.co/t/logstash-https-plugin-not-working/242386)
**Author:** [@rajkumar.m](https://discuss.elastic.co/u/rajkumar.m)\ **Replies:** 9\ **Last updated:** [July 24, 2020, 5:45pm UTC](https://discuss.elastic.co/t/logstash-https-plugin-not-working/242386 "2020-07-24T17:45:29Z")
Hi Team, I am unable to send data with logstash plugin https, someone please help me. I can send data with http without security successfully, but when try to enable ssl, it is failing, please find the below command s… --- ## [Bulk requests are retried indefinitely](https://discuss.elastic.co/t/bulk-requests-are-retried-indefinitely/242488)
**Author:** [@cjmarkham](https://discuss.elastic.co/u/cjmarkham)\ **Replies:** 2\ **Last updated:** [July 24, 2020, 5:45pm UTC](https://discuss.elastic.co/t/bulk-requests-are-retried-indefinitely/242488 "2020-07-24T17:45:14Z")
I have an issue where a bulk request fails from the ELS output plugin. After reading the docs, I saw that these requests are retried indefinitely. However, this blocks the whole pipeline so no new events are consumed. I… --- ## [Winlogbeat Offline Parsing : Ingesting multiple Event Files for DFIR](https://discuss.elastic.co/t/winlogbeat-offline-parsing-ingesting-multiple-event-files-for-dfir/242549)
**Author:** [@hilo21](https://discuss.elastic.co/u/hilo21)\ **Replies:** 0\ **Last updated:** [July 24, 2020, 5:35pm UTC](https://discuss.elastic.co/t/winlogbeat-offline-parsing-ingesting-multiple-event-files-for-dfir/242549 "2020-07-24T17:35:58Z")
I was trying to use Elastic Stack for forensics investigation purposes. I can parse 1 evtx file with no problem : But I guess Winlogbeat doesn support multiple files : Is there a built in way to do this because I d… --- ## [Should I put the index template & policy in ElasticSearch Cluster? or In Logstash?](https://discuss.elastic.co/t/should-i-put-the-index-template-policy-in-elasticsearch-cluster-or-in-logstash/242532)
**Author:** [@abb](https://discuss.elastic.co/u/abb)\ **Replies:** 0\ **Last updated:** [July 24, 2020, 3:31pm UTC](https://discuss.elastic.co/t/should-i-put-the-index-template-policy-in-elasticsearch-cluster-or-in-logstash/242532 "2020-07-24T15:31:35Z")
I am having trouble finding the path to put my template and policy in ES or Logstash. I know logstash stores default template path at vendor -\> Path When I referred ES 7.8.0 documentation for policy (Here) & it also sa… --- ## [Filebeat doc has both message and error.message fields](https://discuss.elastic.co/t/filebeat-doc-has-both-message-and-error-message-fields/242528)
**Author:** [@srpine](https://discuss.elastic.co/u/srpine)\ **Replies:** 0\ **Last updated:** [July 24, 2020, 3:06pm UTC](https://discuss.elastic.co/t/filebeat-doc-has-both-message-and-error-message-fields/242528 "2020-07-24T15:06:37Z")
I installed filebeat on several of my elastic cluster nodes and I am seeing docs from the (node)\_server.json that have both a message field and an error.message field complaining about Provided Grok expressions do not ma… --- ## [IIS Custom Fields logging in Elasticsearch with Filebeat](https://discuss.elastic.co/t/iis-custom-fields-logging-in-elasticsearch-with-filebeat/242525)
**Author:** [@Kunjan\_Sanghavi](https://discuss.elastic.co/u/Kunjan_Sanghavi)\ **Replies:** 1\ **Last updated:** [July 24, 2020, 2:55pm UTC](https://discuss.elastic.co/t/iis-custom-fields-logging-in-elasticsearch-with-filebeat/242525 "2020-07-24T14:55:31Z")
I am using Filebeat to ship my IIS logs to Elasticsearch. I enables the IIS module and its successfully shipping the logs. I have few custom fields which I am writing in IIS logs files. I am seeing the correct value of … --- ## [Elasticsearch throwing number of documents in the index cannot exceed 2147483519](https://discuss.elastic.co/t/elasticsearch-throwing-number-of-documents-in-the-index-cannot-exceed-2147483519/242512)
**Author:** [@Ganesh2303](https://discuss.elastic.co/u/Ganesh2303)\ **Replies:** 2\ **Last updated:** [July 24, 2020, 2:17pm UTC](https://discuss.elastic.co/t/elasticsearch-throwing-number-of-documents-in-the-index-cannot-exceed-2147483519/242512 "2020-07-24T14:17:27Z")
HI Team, I'm using monthly index to store all my data in elasticsearch. i have enabled DLQ to capture the unformatted log information and in that im getting capture below error. elasticsearch ±Could not index event t… --- ## [Unable to login to Kibana by using LDAP user who is having a superuser role](https://discuss.elastic.co/t/unable-to-login-to-kibana-by-using-ldap-user-who-is-having-a-superuser-role/242218)
**Author:** [@elkusergrr](https://discuss.elastic.co/u/elkusergrr)\ **Replies:** 7\ **Last updated:** [July 24, 2020, 1:36pm UTC](https://discuss.elastic.co/t/unable-to-login-to-kibana-by-using-ldap-user-who-is-having-a-superuser-role/242218 "2020-07-24T13:36:24Z")
Hi, I am unable to login to Kibana by using an LDAP user who is having a superuser role. Getting below the exception. {"statusCode":401,"error":"Unauthorized","message":"\[security\_exception\] unable to authenticate user… --- ## [Esrally error - Could not initialize internal actor system](https://discuss.elastic.co/t/esrally-error-could-not-initialize-internal-actor-system/240993)
**Author:** [@pro.shivansh](https://discuss.elastic.co/u/pro.shivansh)\ **Replies:** 3\ **Last updated:** [July 24, 2020, 1:35pm UTC](https://discuss.elastic.co/t/esrally-error-could-not-initialize-internal-actor-system/240993 "2020-07-24T13:35:58Z")
Hello everyone, I was running a benchmark-only for a cluster and ran into an error as described below. I would really appreciate it if someone can help me figure out why is this error occurring and a possible resolution. … --- ## [Getting error index.max\_inner\_result\_window during rolling upgrade of ES from 5.6.10 to 6.8.10](https://discuss.elastic.co/t/getting-error-index-max-inner-result-window-during-rolling-upgrade-of-es-from-5-6-10-to-6-8-10/242210)
**Author:** [@het](https://discuss.elastic.co/u/het)\ **Replies:** 1\ **Last updated:** [July 24, 2020, 1:09pm UTC](https://discuss.elastic.co/t/getting-error-index-max-inner-result-window-during-rolling-upgrade-of-es-from-5-6-10-to-6-8-10/242210 "2020-07-24T13:09:12Z")
Hi team, I have 2 data nodes and 3 master nodes in an ES cluster. I was doing a rolling upgrade as ES suggested moving from 5.6.10 to 6.8.10. As there should be zero downtime, I was testing that and getting one error. … --- ## [Could not find or load main class error during running](https://discuss.elastic.co/t/could-not-find-or-load-main-class-error-during-running/242509)
**Author:** [@Divyam\_Madhok](https://discuss.elastic.co/u/Divyam_Madhok)\ **Replies:** 0\ **Last updated:** [July 24, 2020, 12:19pm UTC](https://discuss.elastic.co/t/could-not-find-or-load-main-class-error-during-running/242509 "2020-07-24T12:19:27Z")
Error: Could not find or load main class Madhok\\AppData\\Local\\Temp\\elasticsearch Caused by: java.lang.ClassNotFoundException: Madhok\\AppData\\Local\\Temp\\elasticsearch ElasticSearch Version=7.8.0 Java Version="1.8.0\_261… --- ## [\[Benchmark\] fail 50% throw exception None of the configured nodes were available](https://discuss.elastic.co/t/benchmark-fail-50-throw-exception-none-of-the-configured-nodes-were-available/242502)
**Author:** [@Dongtuhust](https://discuss.elastic.co/u/Dongtuhust)\ **Replies:** 1\ **Last updated:** [July 24, 2020, 11:25am UTC](https://discuss.elastic.co/t/benchmark-fail-50-throw-exception-none-of-the-configured-nodes-were-available/242502 "2020-07-24T11:25:31Z")
I use PreBuiltXPackTransportClient in my java code public class EsUtil { private static Logger logger = LoggerFactory.getLogger(EsUtil.class); private static final String PROP\_NAME = "config.properties"; … --- ## [Elasticsearch Spring JSONObject\[“hits”\] not found](https://discuss.elastic.co/t/elasticsearch-spring-jsonobject-hits-not-found/242503)
**Author:** [@tosunkaya](https://discuss.elastic.co/u/tosunkaya)\ **Replies:** 0\ **Last updated:** [July 24, 2020, 11:26am UTC](https://discuss.elastic.co/t/elasticsearch-spring-jsonobject-hits-not-found/242503 "2020-07-24T11:26:29Z")
I'm trying to do full text query search on if i GET http://localhost:8080/search/query/tes it should show users include tes in first or last name. i implemented them. but something is wrong, it says hits not found (JSONO… --- ## [Encoding URI kibana](https://discuss.elastic.co/t/encoding-uri-kibana/242495)
**Author:** [@hedia](https://discuss.elastic.co/u/hedia)\ **Replies:** 1\ **Last updated:** [July 24, 2020, 10:47am UTC](https://discuss.elastic.co/t/encoding-uri-kibana/242495 "2020-07-24T10:47:16Z")
I have to embed uri of dashboard kibana in my app web, i have to pass a parameter in my uri witch is a filter by any term(field) in the dashboard. the problem is that the final user can read the parameter from source and… --- ## [Enrich policy execution in elastic search](https://discuss.elastic.co/t/enrich-policy-execution-in-elastic-search/242496)
**Author:** [@anjilinga](https://discuss.elastic.co/u/anjilinga)\ **Replies:** 0\ **Last updated:** [July 24, 2020, 10:42am UTC](https://discuss.elastic.co/t/enrich-policy-execution-in-elastic-search/242496 "2020-07-24T10:42:14Z")
Hi, I have created one enrich policy on one source index and used in ingest pipeline to enrich the data. my source index also will update if any new master data is added. the added new data is not enriching for the inc… --- ## [Stuck Installing 7.6 on Raspberry Pi 4 - curl: (7) Failed to connect to 192.168.1.20 port 9200: Connection refused](https://discuss.elastic.co/t/stuck-installing-7-6-on-raspberry-pi-4-curl-7-failed-to-connect-to-192-168-1-20-port-9200-connection-refused/241740)
**Author:** [@ShaunM1976](https://discuss.elastic.co/u/ShaunM1976)\ **Replies:** 5\ **Last updated:** [July 24, 2020, 10:38am UTC](https://discuss.elastic.co/t/stuck-installing-7-6-on-raspberry-pi-4-curl-7-failed-to-connect-to-192-168-1-20-port-9200-connection-refused/241740 "2020-07-24T10:38:22Z")
Hello lovely people, any experienced people out there that can help a newbie? I'm trying to install elasticsearch on my Pi 4 so I can install Magento 2.4 on it. I'm using a brand new Pi 4 with new installation of Raspbi… --- ## [Increase disk allocation for Elastic Search on linux](https://discuss.elastic.co/t/increase-disk-allocation-for-elastic-search-on-linux/242470)
**Author:** [@rao7806](https://discuss.elastic.co/u/rao7806)\ **Replies:** 3\ **Last updated:** [July 24, 2020, 10:00am UTC](https://discuss.elastic.co/t/increase-disk-allocation-for-elastic-search-on-linux/242470 "2020-07-24T10:00:19Z")
We are trying to index large datasets to elastic search and indexing is stopped due to watermark reached and nodes are set to read-only. We ran the command GET /\_cat/allocation?v and from the output, we came to know t… --- ## [Is there a way to prevent Kibana users from using Search and Add/change filter functions?](https://discuss.elastic.co/t/is-there-a-way-to-prevent-kibana-users-from-using-search-and-add-change-filter-functions/242338)
**Author:** [@ErwinEnableU](https://discuss.elastic.co/u/ErwinEnableU)\ **Replies:** 2\ **Last updated:** [July 24, 2020, 9:35am UTC](https://discuss.elastic.co/t/is-there-a-way-to-prevent-kibana-users-from-using-search-and-add-change-filter-functions/242338 "2020-07-24T09:35:04Z")
For some users I would like to be able to disable the search bar and the Add filter (and change filter) at the top of the Kibana screen. Is there a way to do this? I would like to disable this: --- ## [Speed Up Date range query](https://discuss.elastic.co/t/speed-up-date-range-query/242467)
**Author:** [@KBD-10](https://discuss.elastic.co/u/KBD-10)\ **Replies:** 4\ **Last updated:** [July 24, 2020, 9:02am UTC](https://discuss.elastic.co/t/speed-up-date-range-query/242467 "2020-07-24T09:02:55Z")
Hello every body, First of all I would like to thank you for your help. My problem is about query slow response. I have read a lot in the forum about the cluster configuration, shards and so on, and this is finally my … --- ## [Failed to join a cluster because of time-out](https://discuss.elastic.co/t/failed-to-join-a-cluster-because-of-time-out/238360)
**Author:** [@dasolyn](https://discuss.elastic.co/u/dasolyn)\ **Replies:** 5\ **Last updated:** [June 26, 2020, 2:56pm UTC](https://discuss.elastic.co/t/failed-to-join-a-cluster-because-of-time-out/238360 "2020-06-26T14:56:44Z")
I'm trying to build ElasticSearch cluster but it cause an error. Log for master node (All IPs and comments were omitted due to privacy) \[2020-06-23T16:33:47,361\]\[WARN \]\[o.e.c.c.Coordinator \] \[kn-log-01\] failed to … --- ## [Logstash output plugin for slack](https://discuss.elastic.co/t/logstash-output-plugin-for-slack/242297)
**Author:** [@marttonso](https://discuss.elastic.co/u/marttonso)\ **Replies:** 1\ **Last updated:** [July 24, 2020, 8:34am UTC](https://discuss.elastic.co/t/logstash-output-plugin-for-slack/242297 "2020-07-24T08:34:35Z")
Hello, I'd like to get a few more urgent log messages into slack channel. They're not critical enough to route to Pagerduty and create alerts & incidents, otherwise I could send them to Slack from there. The output plu… --- ## [Master Node toggles permanently](https://discuss.elastic.co/t/master-node-toggles-permanently/242284)
**Author:** [@michael\_0815](https://discuss.elastic.co/u/michael_0815)\ **Replies:** 6\ **Last updated:** [July 24, 2020, 8:08am UTC](https://discuss.elastic.co/t/master-node-toggles-permanently/242284 "2020-07-24T08:08:20Z")
Hi there, we have an issue that we have constantly toggling of the master node - it leaves and joins permanently. We deleted all nodes including pvc and started all over. Same issue in AKS again. It´s a 3 node setup. L… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1906) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1908)