# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1908 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1909 --- ## [Elasticsearch Service won't start](https://discuss.elastic.co/t/elasticsearch-service-wont-start/242264)
**Author:** [@Jensxy](https://discuss.elastic.co/u/Jensxy)\ **Replies:** 25\ **Last updated:** [July 24, 2020, 8:06am UTC](https://discuss.elastic.co/t/elasticsearch-service-wont-start/242264 "2020-07-24T08:06:56Z")
After adding some memory to our server and rebooting it afterward, Elasticsearch does not start anymore. I am using ES 7.8.0 I execute sudo systemctl start elasticsearch.service and get the following error Job for el… --- ## [Timelion](https://discuss.elastic.co/t/timelion/241889)
**Author:** [@g\_k\_b](https://discuss.elastic.co/u/g_k_b)\ **Replies:** 6\ **Last updated:** [July 24, 2020, 8:03am UTC](https://discuss.elastic.co/t/timelion/241889 "2020-07-24T08:03:15Z")
Hi everyone, I'm using Timelion and wht I would love to do now is setting a different color for data with timestamp from 9pm to 7am. How can I write the query? I read about the syntax FROM...TO but the examples I foun… --- ## [Spaces in JVM options](https://discuss.elastic.co/t/spaces-in-jvm-options/242475)
**Author:** [@sts](https://discuss.elastic.co/u/sts)\ **Replies:** 0\ **Last updated:** [July 24, 2020, 7:50am UTC](https://discuss.elastic.co/t/spaces-in-jvm-options/242475 "2020-07-24T07:50:08Z")
I want to add "-XX:OnOutOfMemoryError=kill %p" to the Elasticsearch JVM options. No matter which way I try, I can't make it work. I think it's because the jvm.options parser always separates on spaces, is that true? Is t… --- ## [Nested Query in ES](https://discuss.elastic.co/t/nested-query-in-es/242471)
**Author:** [@mitelastic](https://discuss.elastic.co/u/mitelastic)\ **Replies:** 0\ **Last updated:** [July 24, 2020, 7:43am UTC](https://discuss.elastic.co/t/nested-query-in-es/242471 "2020-07-24T07:43:46Z")
I have an index with below fields SimID - Guid, UserId - Guid, WhenUserTrained - Datetime, WhenUserClicked - Datetime. Now I want to get the user count for given simulation who trained in past under any simulaton. … --- ## [Trouble with log in UCS-2 LE BOM encoding](https://discuss.elastic.co/t/trouble-with-log-in-ucs-2-le-bom-encoding/198487)
**Author:** [@\_finack](https://discuss.elastic.co/u/_finack)\ **Replies:** 2\ **Last updated:** [July 24, 2020, 7:12am UTC](https://discuss.elastic.co/t/trouble-with-log-in-ucs-2-le-bom-encoding/198487 "2020-07-24T07:12:28Z")
I'm new to filebeat. I have a log file in UCS-2 LE BOM encoding. Log entries are each their own valid JSON object, one per line. Filebeat does not seem to like the UCS-2 LE BOM encoding. I'm seeing the following in the … --- ## [Using Logstash http input filter, what is the max file size limit can be sent to it?](https://discuss.elastic.co/t/using-logstash-http-input-filter-what-is-the-max-file-size-limit-can-be-sent-to-it/240839)
**Author:** [@Agniv\_Gon](https://discuss.elastic.co/u/Agniv_Gon)\ **Replies:** 1\ **Last updated:** [July 24, 2020, 7:06am UTC](https://discuss.elastic.co/t/using-logstash-http-input-filter-what-is-the-max-file-size-limit-can-be-sent-to-it/240839 "2020-07-24T07:06:55Z")
I am using Logstash 7.7.1 and using below conf for my logstash. I am trying to send .gz file and in header passing Content-Encoding: gzip which is working fine. But I am clueless about the max size limit which I can send… --- ## [Logstash http input plugin accepting gzip file but how to detect only text format?](https://discuss.elastic.co/t/logstash-http-input-plugin-accepting-gzip-file-but-how-to-detect-only-text-format/240683)
**Author:** [@Agniv\_Gon](https://discuss.elastic.co/u/Agniv_Gon)\ **Replies:** 4\ **Last updated:** [July 24, 2020, 6:51am UTC](https://discuss.elastic.co/t/logstash-http-input-plugin-accepting-gzip-file-but-how-to-detect-only-text-format/240683 "2020-07-24T06:51:22Z")
I am using the below conf for Logstash HTTP input plugin: I am trying to send .gz file and in header passing Content-Encoding: gzip. It is successfully doing its job but I am interested only in text format inside the gzi… --- ## [How to downgrade Elasticsearch 5.6.x Snapshot version?](https://discuss.elastic.co/t/how-to-downgrade-elasticsearch-5-6-x-snapshot-version/242423)
**Author:** [@Jayden\_Chew](https://discuss.elastic.co/u/Jayden_Chew)\ **Replies:** 5\ **Last updated:** [July 24, 2020, 5:13am UTC](https://discuss.elastic.co/t/how-to-downgrade-elasticsearch-5-6-x-snapshot-version/242423 "2020-07-24T05:13:33Z")
I've been attempting to migrate about 3TB of data from an AWS Elasticsearch Service cluster to a self managed Elasticsearch cluster made with EC2 instances. I was going to use snapshots to help with transferring all this… --- ## [ElasticSearch full text query (using multi-match) need to give more importance to document which starts with matched word](https://discuss.elastic.co/t/elasticsearch-full-text-query-using-multi-match-need-to-give-more-importance-to-document-which-starts-with-matched-word/242451)
**Author:** [@saikirant](https://discuss.elastic.co/u/saikirant)\ **Replies:** 0\ **Last updated:** [July 24, 2020, 5:20am UTC](https://discuss.elastic.co/t/elasticsearch-full-text-query-using-multi-match-need-to-give-more-importance-to-document-which-starts-with-matched-word/242451 "2020-07-24T05:20:38Z")
I have 2 documents whose fields are as follows. Doc1: "Identity Vijay" Doc2: "Vijay Identity" When I search for 'identity' both documents are appearing with same score. Ideally I want 'Doc1' to have higher score as 'm… --- ## [Trying to calculate differences between 2 timestamps](https://discuss.elastic.co/t/trying-to-calculate-differences-between-2-timestamps/242443)
**Author:** [@windowsrefund\_refund](https://discuss.elastic.co/u/windowsrefund_refund)\ **Replies:** 4\ **Last updated:** [July 24, 2020, 5:19am UTC](https://discuss.elastic.co/t/trying-to-calculate-differences-between-2-timestamps/242443 "2020-07-24T05:19:27Z")
input { generator { message =\> "Jul 24 03:35:03 myhost metricbeat: 2020-07-24T03:35:03.788Z#011INFO#011\[publisher\]#011pipeline/retry.go:225#011 done" count =\> 1 } } filter { grok { match =\> { "messag… --- ## [Send kafka topics to different elastic search hosts through logstash](https://discuss.elastic.co/t/send-kafka-topics-to-different-elastic-search-hosts-through-logstash/242446)
**Author:** [@ankit9787](https://discuss.elastic.co/u/ankit9787)\ **Replies:** 1\ **Last updated:** [July 24, 2020, 5:14am UTC](https://discuss.elastic.co/t/send-kafka-topics-to-different-elastic-search-hosts-through-logstash/242446 "2020-07-24T05:14:00Z")
I have created one logstash conf file and reading kafka topic and trying to send to different elastic search deployed on different servers. Can you please help, what I am doing wrong. Nothings happening. Below my code W… --- ## [Logstash SNS output failing](https://discuss.elastic.co/t/logstash-sns-output-failing/242273)
**Author:** [@Vishnuvardhan\_K](https://discuss.elastic.co/u/Vishnuvardhan_K)\ **Replies:** 7\ **Last updated:** [July 24, 2020, 5:08am UTC](https://discuss.elastic.co/t/logstash-sns-output-failing/242273 "2020-07-24T05:08:58Z")
Hi, I am trying to send the logs to the SNS topic through Filebeat and Logstash. But it is failing with the attached below the message. When I try to send the output to stdout, then it works without any issues. Can so… --- ## [Suggestion for field name](https://discuss.elastic.co/t/suggestion-for-field-name/242105)
**Author:** [@opoplawski](https://discuss.elastic.co/u/opoplawski)\ **Replies:** 5\ **Last updated:** [July 24, 2020, 3:50am UTC](https://discuss.elastic.co/t/suggestion-for-field-name/242105 "2020-07-24T03:50:22Z")
I'm parsing logs from e2guardian - a web filter. One of the fields is basically "why" a request was block. For e.g.: 2020.04.06 12:21:37 - 10.11.2.22 https://stats.g.doubleclick.net/r/collect?v=1&aip=… --- ## [Ship logs from multiple filebeat instances running on different machines to single logstash server](https://discuss.elastic.co/t/ship-logs-from-multiple-filebeat-instances-running-on-different-machines-to-single-logstash-server/242435)
**Author:** [@Gyanprakash\_Mishra](https://discuss.elastic.co/u/Gyanprakash_Mishra)\ **Replies:** 0\ **Last updated:** [July 24, 2020, 3:49am UTC](https://discuss.elastic.co/t/ship-logs-from-multiple-filebeat-instances-running-on-different-machines-to-single-logstash-server/242435 "2020-07-24T03:49:07Z")
I have following scenario : multiple applications running on different server spread across region. How should I configure system so that i have filebeat instance running on each application server and sending data to on… --- ## [Ask for recommendation to monitor 1000 PC with Metricbeat](https://discuss.elastic.co/t/ask-for-recommendation-to-monitor-1000-pc-with-metricbeat/242434)
**Author:** [@ahmad.ar](https://discuss.elastic.co/u/ahmad.ar)\ **Replies:** 0\ **Last updated:** [July 24, 2020, 3:36am UTC](https://discuss.elastic.co/t/ask-for-recommendation-to-monitor-1000-pc-with-metricbeat/242434 "2020-07-24T03:36:04Z")
Hallo Everything, can I ask for advice, how should I build elasticsearch cluster if I want to monitor 1000 PC with Metricbeat with 3 months data retention. How many nodes do I need to prepare, is it necessary to dedicate… --- ## [Logstash s3 output plugin storing files as .txt instead of .json on s3](https://discuss.elastic.co/t/logstash-s3-output-plugin-storing-files-as-txt-instead-of-json-on-s3/242431)
**Author:** [@jericomaramot](https://discuss.elastic.co/u/jericomaramot)\ **Replies:** 0\ **Last updated:** [July 24, 2020, 3:18am UTC](https://discuss.elastic.co/t/logstash-s3-output-plugin-storing-files-as-txt-instead-of-json-on-s3/242431 "2020-07-24T03:18:33Z")
Hi, I need to store my logstash output to s3 as json file. But upon checking the output files in s3, it is stored as .txt format. Here is my output code: output { s3 { region =\> "${elkRegion}" … --- ## [Data table disappears using "Top Hit" aggregation](https://discuss.elastic.co/t/data-table-disappears-using-top-hit-aggregation/242419)
**Author:** [@Ram2416](https://discuss.elastic.co/u/Ram2416)\ **Replies:** 6\ **Last updated:** [July 24, 2020, 2:16am UTC](https://discuss.elastic.co/t/data-table-disappears-using-top-hit-aggregation/242419 "2020-07-24T02:16:28Z")
Hi, I'm working on creating a data table using "Top Hit" aggregation in Kibana version 6.6.0. I'm encountering a unique problem which I'm not able to figure out. For few of the parameters, I'm able to sort and display… --- ## [How to upgrade my ElasticSearch](https://discuss.elastic.co/t/how-to-upgrade-my-elasticsearch/242036)
**Author:** [@Felipe](https://discuss.elastic.co/u/Felipe)\ **Replies:** 11\ **Last updated:** [July 24, 2020, 1:08am UTC](https://discuss.elastic.co/t/how-to-upgrade-my-elasticsearch/242036 "2020-07-24T01:08:31Z")
Hey gus, hope everybody is doing good! I'm having a problem to upgrade my ES cluster and i'm really lost on how many nodes do i need, their role, their hardware. Right now, i have 2 nodes which one of them is Master Dat… --- ## [Rally freezes at the end](https://discuss.elastic.co/t/rally-freezes-at-the-end/242265)
**Author:** [@kinlee](https://discuss.elastic.co/u/kinlee)\ **Replies:** 2\ **Last updated:** [July 23, 2020, 11:21pm UTC](https://discuss.elastic.co/t/rally-freezes-at-the-end/242265 "2020-07-23T23:21:12Z")
My rally freezes at the end and would not print the results. In the logs, there is error . elasticsearch WARNING GET https://xxx.xxx.xxx.xxx:9200/\_nodes/stats/\_all \[status:N/A request:950.711s\] Traceback (most recent ca… --- ## [Issues with additional event logs enabled](https://discuss.elastic.co/t/issues-with-additional-event-logs-enabled/242416)
**Author:** [@rmoat](https://discuss.elastic.co/u/rmoat)\ **Replies:** 0\ **Last updated:** [July 23, 2020, 10:38pm UTC](https://discuss.elastic.co/t/issues-with-additional-event-logs-enabled/242416 "2020-07-23T22:38:44Z")
Hello, I am trying to get events from two separate logs on our domain controllers, and just realized today that the entire Security log was not being sent to Kibana by winlogbeat after I tried to send events from a seco… --- ## [How to track the stream of documents inputed in Logstash by Elastic search input plugin?](https://discuss.elastic.co/t/how-to-track-the-stream-of-documents-inputed-in-logstash-by-elastic-search-input-plugin/242417)
**Author:** [@lucasbemol](https://discuss.elastic.co/u/lucasbemol)\ **Replies:** 0\ **Last updated:** [July 23, 2020, 11:10pm UTC](https://discuss.elastic.co/t/how-to-track-the-stream-of-documents-inputed-in-logstash-by-elastic-search-input-plugin/242417 "2020-07-23T23:10:53Z")
I'm having some problems with ElasticSearch. Keeping it short, I need to look into my logs and normalize them in various indexes. My logs are stored in both an index of ElasticSearch and in a relational database. These … --- ## [Ingest pipeline for text analysis?](https://discuss.elastic.co/t/ingest-pipeline-for-text-analysis/241857)
**Author:** [@yolo](https://discuss.elastic.co/u/yolo)\ **Replies:** 11\ **Last updated:** [July 23, 2020, 10:07pm UTC](https://discuss.elastic.co/t/ingest-pipeline-for-text-analysis/241857 "2020-07-23T22:07:19Z")
Hi community, is it possible to apply text analysis on search index using ingest pipelines? i still did not find any processor suitable for this task. The idea is to detect the language using inference processor from in… --- ## [NegativeArraySizeException: -1680966849, HostUnreachableError and OOM](https://discuss.elastic.co/t/negativearraysizeexception-1680966849-hostunreachableerror-and-oom/242366)
**Author:** [@rajdevworks](https://discuss.elastic.co/u/rajdevworks)\ **Replies:** 4\ **Last updated:** [July 23, 2020, 10:04pm UTC](https://discuss.elastic.co/t/negativearraysizeexception-1680966849-hostunreachableerror-and-oom/242366 "2020-07-23T22:04:30Z")
On our ELK stack, while ingesting bulk logs, we are seeing HostUnreachableError often followed by connection restoration message in logstash.err. Following that we see NegativeArraySizeException: -1680966849 multiple tim… --- ## [Need some help creating a complex query/aggregation](https://discuss.elastic.co/t/need-some-help-creating-a-complex-query-aggregation/242402)
**Author:** [@sKurryBoii](https://discuss.elastic.co/u/sKurryBoii)\ **Replies:** 0\ **Last updated:** [July 23, 2020, 8:51pm UTC](https://discuss.elastic.co/t/need-some-help-creating-a-complex-query-aggregation/242402 "2020-07-23T20:51:04Z")
I'm trying to create a query to help create a retention cohort. Essentially, my index consists of many records with the fields username,timestamp,taskCompleted From this data I'm trying to group users into weeks (based… --- ## [Add mapping to unmapped field](https://discuss.elastic.co/t/add-mapping-to-unmapped-field/242369)
**Author:** [@JulienCarnec](https://discuss.elastic.co/u/JulienCarnec)\ **Replies:** 2\ **Last updated:** [July 23, 2020, 8:45pm UTC](https://discuss.elastic.co/t/add-mapping-to-unmapped-field/242369 "2020-07-23T20:45:16Z")
Is there a way to store an unmapped field in documents, and then later on, create a mapping for this unmapped field to have it searchable, without having to reindex all my docs in a new index? Here is what I do: 1- cre… --- ## [How I can set up logstash with debian packages](https://discuss.elastic.co/t/how-i-can-set-up-logstash-with-debian-packages/241533)
**Author:** [@Splunk](https://discuss.elastic.co/u/Splunk)\ **Replies:** 3\ **Last updated:** [July 16, 2020, 11:11pm UTC](https://discuss.elastic.co/t/how-i-can-set-up-logstash-with-debian-packages/241533 "2020-07-16T23:11:45Z")
I feel like it is a waste of time to deal with Debian packages, can anyone tell me how I can set up logstash with Debian packages? I followed the instruction on elastic website, how can i access to logstash conf file h… --- ## [Logstash multiple pipelines processing](https://discuss.elastic.co/t/logstash-multiple-pipelines-processing/242392)
**Author:** [@FranB](https://discuss.elastic.co/u/FranB)\ **Replies:** 2\ **Last updated:** [July 23, 2020, 8:27pm UTC](https://discuss.elastic.co/t/logstash-multiple-pipelines-processing/242392 "2020-07-23T20:27:22Z")
Hello, i have this doubt: if i have 4 pipelines in the pipelines.yml file, one instance of logstash will process and output at the same time/in parallel for those 4 different type of pipelines or will they work as the f… --- ## [Passing Parent Aggregate Key into the child Aggregate Scripting language](https://discuss.elastic.co/t/passing-parent-aggregate-key-into-the-child-aggregate-scripting-language/242398)
**Author:** [@amrit.khatri](https://discuss.elastic.co/u/amrit.khatri)\ **Replies:** 0\ **Last updated:** [July 23, 2020, 8:23pm UTC](https://discuss.elastic.co/t/passing-parent-aggregate-key-into-the-child-aggregate-scripting-language/242398 "2020-07-23T20:23:16Z")
I have a quick question about passing the filters key to the scripted language from parent aggregate to child aggregate. Basically, I have defined the filters as below, In my scripted query, I want to use the filter ke… --- ## [Filebeat and data.json file, field meaning and service tunning](https://discuss.elastic.co/t/filebeat-and-data-json-file-field-meaning-and-service-tunning/242278)
**Author:** [@d.silwon](https://discuss.elastic.co/u/d.silwon)\ **Replies:** 0\ **Last updated:** [July 23, 2020, 5:54am UTC](https://discuss.elastic.co/t/filebeat-and-data-json-file-field-meaning-and-service-tunning/242278 "2020-07-23T05:54:05Z")
Dears, The filebeat service have file data.json in /var/lib/filebeat/registry/filebeat. The content of this file looks like: \[ "soure":"/apps/logs/my\_apps/file.log","offset":"308017933","timestamp":"2020-07-23T07:20:38… --- ## [Logstash error after configuring ssl in the logstash.conf](https://discuss.elastic.co/t/logstash-error-after-configuring-ssl-in-the-logstash-conf/242262)
**Author:** [@Matish\_Bhuyan](https://discuss.elastic.co/u/Matish_Bhuyan)\ **Replies:** 9\ **Last updated:** [July 23, 2020, 7:39pm UTC](https://discuss.elastic.co/t/logstash-error-after-configuring-ssl-in-the-logstash-conf/242262 "2020-07-23T19:39:59Z")
Hi All , I have configured my elk stack to use ssl settings and after the change in Kibana and elasticsearch i have updated the logstash configuration , I am able to connect to my elasticsearch cluster from logstash as… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1907) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1909)