# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1910 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1911 --- ## [Set up 2 node cluster with 2 different machine](https://discuss.elastic.co/t/set-up-2-node-cluster-with-2-different-machine/242307)
**Author:** [@Ankur](https://discuss.elastic.co/u/Ankur)\ **Replies:** 1\ **Last updated:** [July 23, 2020, 11:09am UTC](https://discuss.elastic.co/t/set-up-2-node-cluster-with-2-different-machine/242307 "2020-07-23T11:09:25Z")
I want to setup 2 node elastic cluster (1 master & 1 data ). but unable to connect the data node. plz suggest any yml setting. --- ## [Terminate Logstash when using pipeline-to-pipelines communication](https://discuss.elastic.co/t/terminate-logstash-when-using-pipeline-to-pipelines-communication/238110)
**Author:** [@glenacota](https://discuss.elastic.co/u/glenacota)\ **Replies:** 3\ **Last updated:** [July 23, 2020, 10:49am UTC](https://discuss.elastic.co/t/terminate-logstash-when-using-pipeline-to-pipelines-communication/238110 "2020-07-23T10:49:04Z")
Hi, this is a duplicated of a question I posted last year, and yet unanswered/unsolved (original question). I would like to use one of the pipeline-to-pipeline architecture patterns, say, the forked path pattern. The in… --- ## [License Issue](https://discuss.elastic.co/t/license-issue/242288)
**Author:** [@GrexAut](https://discuss.elastic.co/u/GrexAut)\ **Replies:** 4\ **Last updated:** [July 23, 2020, 10:34am UTC](https://discuss.elastic.co/t/license-issue/242288 "2020-07-23T10:34:58Z")
Hello, I'm new to ELK, and would like to use the CSV Export function. So I read at https://www.elastic.co/de/subscriptions , that I need a basic license. Anyway, I have already unlimt basic license (why?), I registered… --- ## [Error in java api network client connecting to elastic node](https://discuss.elastic.co/t/error-in-java-api-network-client-connecting-to-elastic-node/242321)
**Author:** [@Imrankhan\_Patan](https://discuss.elastic.co/u/Imrankhan_Patan)\ **Replies:** 0\ **Last updated:** [July 23, 2020, 10:17am UTC](https://discuss.elastic.co/t/error-in-java-api-network-client-connecting-to-elastic-node/242321 "2020-07-23T10:17:15Z")
I am facing an issue with while trying to insert/ read from Elasticsearch 7.2 on single node with Spring boot Java transport client referring to the link https://dzone.com/articles/spring-boot-elasticsearch "exception":… --- ## [Using kv to produce fields with every word capitalized](https://discuss.elastic.co/t/using-kv-to-produce-fields-with-every-word-capitalized/242058)
**Author:** [@username11](https://discuss.elastic.co/u/username11)\ **Replies:** 2\ **Last updated:** [July 23, 2020, 10:07am UTC](https://discuss.elastic.co/t/using-kv-to-produce-fields-with-every-word-capitalized/242058 "2020-07-23T10:07:58Z")
I am using kv to parse a certain log that contains comma-separated key-value pairs. However, the keys may contain multiple space-separated words with inconsistent capitalization, and I'm trying to bring the resulting fie… --- ## [ES index automatic mapping update](https://discuss.elastic.co/t/es-index-automatic-mapping-update/242078)
**Author:** [@Antonio\_Antovski](https://discuss.elastic.co/u/Antonio_Antovski)\ **Replies:** 3\ **Last updated:** [July 23, 2020, 9:56am UTC](https://discuss.elastic.co/t/es-index-automatic-mapping-update/242078 "2020-07-23T09:56:58Z")
I have a Python script that synchronizes the data between a relational database and ElasticSearch, i.e. on every new insert into the relational database, the data is being inserted into the ES index too. But, whenever I … --- ## [Issue with output kafka multiple topics](https://discuss.elastic.co/t/issue-with-output-kafka-multiple-topics/242316)
**Author:** [@svasilyev](https://discuss.elastic.co/u/svasilyev)\ **Replies:** 0\ **Last updated:** [July 23, 2020, 9:55am UTC](https://discuss.elastic.co/t/issue-with-output-kafka-multiple-topics/242316 "2020-07-23T09:55:13Z")
i use filebeat 7.8.0 in Docker-Compose OS rhel 7 When I try to write logs for multiple topics in kafka, the logs are added to kafka (always one topic (containerlogs) with no selection) logs are received at the time of… --- ## [Parsing for syslog in Filebeat](https://discuss.elastic.co/t/parsing-for-syslog-in-filebeat/242314)
**Author:** [@misheck](https://discuss.elastic.co/u/misheck)\ **Replies:** 0\ **Last updated:** [July 23, 2020, 9:44am UTC](https://discuss.elastic.co/t/parsing-for-syslog-in-filebeat/242314 "2020-07-23T09:44:39Z")
I have filebeat installed on a Centos vm to collect local logs via flat file and also receive syslog on Port 9000 from a remote Centos Machine. I am collecting logs from computers but I have noticed that the Filebeat EC… --- ## [How to read property name which is inside JSON for alert?](https://discuss.elastic.co/t/how-to-read-property-name-which-is-inside-json-for-alert/240051)
**Author:** [@gunjan\_prmr](https://discuss.elastic.co/u/gunjan_prmr)\ **Replies:** 1\ **Last updated:** [July 23, 2020, 9:33am UTC](https://discuss.elastic.co/t/how-to-read-property-name-which-is-inside-json-for-alert/240051 "2020-07-23T09:33:20Z")
I am able pull the specific index infor by using ctx.results.0.hits.hits.0.\_source.log. This gives me desired result. Now this comes a JSON blob where I want to read particular property but not sure it is possible or not… --- ## [How to set watcher condition when aggregations doc\_count greater then a value](https://discuss.elastic.co/t/how-to-set-watcher-condition-when-aggregations-doc-count-greater-then-a-value/242283)
**Author:** [@hanase](https://discuss.elastic.co/u/hanase)\ **Replies:** 2\ **Last updated:** [July 23, 2020, 9:31am UTC](https://discuss.elastic.co/t/how-to-set-watcher-condition-when-aggregations-doc-count-greater-then-a-value/242283 "2020-07-23T09:31:32Z")
Hi, I search heartbeat-\* indices when status is down and want to send message to telegram My DSL is , GET heartbeat-7.7.0\*/\_search { "query": { "bool": { "must": \[ { "match": { … --- ## [How to set Time range in Watcher](https://discuss.elastic.co/t/how-to-set-time-range-in-watcher/239617)
**Author:** [@skdas](https://discuss.elastic.co/u/skdas)\ **Replies:** 4\ **Last updated:** [July 23, 2020, 9:30am UTC](https://discuss.elastic.co/t/how-to-set-time-range-in-watcher/239617 "2020-07-23T09:30:55Z")
Hello Elastic Team, I am trying to set time range in my below watcher configuration but i am getting an error while configuring the Watcher could you please assist. Watcher Configuration { "trigger": { "schedule"… --- ## [Circuit\_breaking\_exception - Watcher](https://discuss.elastic.co/t/circuit-breaking-exception-watcher/241255)
**Author:** [@ChequredFlag](https://discuss.elastic.co/u/ChequredFlag)\ **Replies:** 2\ **Last updated:** [July 23, 2020, 9:24am UTC](https://discuss.elastic.co/t/circuit-breaking-exception-watcher/241255 "2020-07-23T09:24:56Z")
Hi I have just started using ElasticSearch and have run into an issue when setting up advanced watchers. I have written several watchers to check for application errors. However, they are returning a circuit\_breaking… --- ## [Define field as nested type using Logstash](https://discuss.elastic.co/t/define-field-as-nested-type-using-logstash/242289)
**Author:** [@Yoorae\_Kim](https://discuss.elastic.co/u/Yoorae_Kim)\ **Replies:** 9\ **Last updated:** [July 23, 2020, 9:06am UTC](https://discuss.elastic.co/t/define-field-as-nested-type-using-logstash/242289 "2020-07-23T09:06:39Z")
Hello, I am currently shipping my data to Elasticsearch using Logstash. The inner-hit query I am trying to perform is returning an error saying "failed to create query: \[nested\] nested object under path \[transactions\]… --- ## [High JVM %](https://discuss.elastic.co/t/high-jvm/242239)
**Author:** [@liorg2](https://discuss.elastic.co/u/liorg2)\ **Replies:** 2\ **Last updated:** [July 23, 2020, 7:07am UTC](https://discuss.elastic.co/t/high-jvm/242239 "2020-07-23T07:07:01Z")
Hi I'm using the hosted elastic (v7.8), and having high %JVM most of times. I'm trying to find the root cause for that. what would you recommend to check by the screenshots below? thanks --- ## [Watchers: querying for multiple strings in timeframe](https://discuss.elastic.co/t/watchers-querying-for-multiple-strings-in-timeframe/241211)
**Author:** [@DatBassie](https://discuss.elastic.co/u/DatBassie)\ **Replies:** 1\ **Last updated:** [July 23, 2020, 8:52am UTC](https://discuss.elastic.co/t/watchers-querying-for-multiple-strings-in-timeframe/241211 "2020-07-23T08:52:43Z")
Hi everyone, I've been working to get a watcher configured that will look for either of two options on text in a fields, in ths case message. Of all those, I'd want to alert if any of them happened in the last, say, th… --- ## [Watcher searching for query term containing hyphens](https://discuss.elastic.co/t/watcher-searching-for-query-term-containing-hyphens/241471)
**Author:** [@ChequredFlag](https://discuss.elastic.co/u/ChequredFlag)\ **Replies:** 1\ **Last updated:** [July 23, 2020, 8:48am UTC](https://discuss.elastic.co/t/watcher-searching-for-query-term-containing-hyphens/241471 "2020-07-23T08:48:59Z")
Hi I am trying to return the number of errors reported against a specific application in our stack. The search term i am using is "search" : { "request" : { "indices" : "developme… --- ## [Index Analysis vs search analysis](https://discuss.elastic.co/t/index-analysis-vs-search-analysis/242305)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 0\ **Last updated:** [July 23, 2020, 8:40am UTC](https://discuss.elastic.co/t/index-analysis-vs-search-analysis/242305 "2020-07-23T08:40:32Z")
I have followed this https://www.elastic.co/guide/en/elasticsearch/reference/current/analysis-index-search-time.html "settings": { "analysis": { "analyzer": { "autocomplete": { "tokenizer":"mytoken", "filter":\["l… --- ## [Unable to get a field match watcher to work properly](https://discuss.elastic.co/t/unable-to-get-a-field-match-watcher-to-work-properly/242252)
**Author:** [@mlasky1970](https://discuss.elastic.co/u/mlasky1970)\ **Replies:** 1\ **Last updated:** [July 23, 2020, 8:38am UTC](https://discuss.elastic.co/t/unable-to-get-a-field-match-watcher-to-work-properly/242252 "2020-07-23T08:38:41Z")
I have been trying to get a simple field match condition watcher to work without success. I've combed the forums, combined advice I found here, worked with Support, all to no avail. So I figured I'd post and see if other… --- ## [How to Parse Json http body from a POST request with tcp plugin](https://discuss.elastic.co/t/how-to-parse-json-http-body-from-a-post-request-with-tcp-plugin/240565)
**Author:** [@Bouraoui\_Kacem](https://discuss.elastic.co/u/Bouraoui_Kacem)\ **Replies:** 4\ **Last updated:** [July 23, 2020, 8:19am UTC](https://discuss.elastic.co/t/how-to-parse-json-http-body-from-a-post-request-with-tcp-plugin/240565 "2020-07-23T08:19:30Z")
I send a Post request with a json content from PostMan to logstash pipeline with an input tcp plugin , the model of my data is like : { "results:\[ values :"\\"{..json object.. }\\"" \] } my logstahs input is : … --- ## [Is Elastic Search Supports Partition by Column and Overwrite Specific Partition data within the Same Index?](https://discuss.elastic.co/t/is-elastic-search-supports-partition-by-column-and-overwrite-specific-partition-data-within-the-same-index/242170)
**Author:** [@dillibabu.mekala](https://discuss.elastic.co/u/dillibabu.mekala)\ **Replies:** 5\ **Last updated:** [July 23, 2020, 8:06am UTC](https://discuss.elastic.co/t/is-elastic-search-supports-partition-by-column-and-overwrite-specific-partition-data-within-the-same-index/242170 "2020-07-23T08:06:03Z")
Hi Team, I have a csv file where i need to store this data in index ("carsdata") by partition column. Input CSV (cars-data.csv): carname,enginetype,cost,countryId,modelnumber BMW1,Petrol,10000,1,12 BMW2,Petrol,20000,… --- ## [How to Read logs from Solaris 11.3 SPARC and push to logstash on rhel](https://discuss.elastic.co/t/how-to-read-logs-from-solaris-11-3-sparc-and-push-to-logstash-on-rhel/241358)
**Author:** [@dhanshake](https://discuss.elastic.co/u/dhanshake)\ **Replies:** 3\ **Last updated:** [July 23, 2020, 7:54am UTC](https://discuss.elastic.co/t/how-to-read-logs-from-solaris-11-3-sparc-and-push-to-logstash-on-rhel/241358 "2020-07-23T07:54:40Z")
Hey, Any alternative to Filebeat which helps in reading application / database logs from Solaris server (Solaris 11.3 SPARC) and push it to my logstash on my rhel ? P.s filebeat is not supported in Solaris SPARC syste… --- ## [Sendgrid supports elk configuration](https://discuss.elastic.co/t/sendgrid-supports-elk-configuration/242024)
**Author:** [@nikhilesh](https://discuss.elastic.co/u/nikhilesh)\ **Replies:** 1\ **Last updated:** [July 23, 2020, 7:50am UTC](https://discuss.elastic.co/t/sendgrid-supports-elk-configuration/242024 "2020-07-23T07:50:21Z")
Hi Team, i am configuring sendgrid mail server in elastic search yml file to create alarms. but i was getting below errors in logs, can please help on this. Caused by: javax.mail.AuthenticationFailedException: 451 Aut… --- ## [Clarify high level REST client compatibility between 6 and 7](https://discuss.elastic.co/t/clarify-high-level-rest-client-compatibility-between-6-and-7/241973)
**Author:** [@CanardMoussant](https://discuss.elastic.co/u/CanardMoussant)\ **Replies:** 1\ **Last updated:** [July 23, 2020, 7:46am UTC](https://discuss.elastic.co/t/clarify-high-level-rest-client-compatibility-between-6-and-7/241973 "2020-07-23T07:46:17Z")
I have traffic coming in constantly in my application and I need to migrate from ES6 to 7. According to the doc the client should be migrated last. But will a client 6 work with a cluster in version 7? How this should be… --- ## [S3 input Plugin Logstash](https://discuss.elastic.co/t/s3-input-plugin-logstash/242298)
**Author:** [@Vignesh2912](https://discuss.elastic.co/u/Vignesh2912)\ **Replies:** 0\ **Last updated:** [July 23, 2020, 7:36am UTC](https://discuss.elastic.co/t/s3-input-plugin-logstash/242298 "2020-07-23T07:36:02Z")
Hi Everyone, I am getting the below error in the Logstash. Could you please provide some insight on how to fix this.?? Already tried reinstalling the plugin. \[2020-07-23T06:50:07,402\]\[ERROR\]\[logstash.pipeline \] … --- ## [Processing large amoung of data with Logstash](https://discuss.elastic.co/t/processing-large-amoung-of-data-with-logstash/242020)
**Author:** [@evannobre](https://discuss.elastic.co/u/evannobre)\ **Replies:** 5\ **Last updated:** [July 23, 2020, 7:28am UTC](https://discuss.elastic.co/t/processing-large-amoung-of-data-with-logstash/242020 "2020-07-23T07:28:21Z")
Hi, Sorry for the text, but I tried to detail my problem as much as possible to make it clear. I am part of a medical devices team. We run hundreds of tests over the devices to assure the quality and we save the result… --- ## [Multiple search terms with radius](https://discuss.elastic.co/t/multiple-search-terms-with-radius/242294)
**Author:** [@Phil795](https://discuss.elastic.co/u/Phil795)\ **Replies:** 0\ **Last updated:** [July 23, 2020, 7:23am UTC](https://discuss.elastic.co/t/multiple-search-terms-with-radius/242294 "2020-07-23T07:23:11Z")
For our search engine I want to search in PDF documents for related search terms. For example: oil mist It is relevant that each reference contains oil and mist. In addition, I would like to determine how many words a… --- ## [Correct way to remove unnecessary fields from filebeat](https://discuss.elastic.co/t/correct-way-to-remove-unnecessary-fields-from-filebeat/239443)
**Author:** [@sfenman](https://discuss.elastic.co/u/sfenman)\ **Replies:** 1\ **Last updated:** [July 23, 2020, 7:19am UTC](https://discuss.elastic.co/t/correct-way-to-remove-unnecessary-fields-from-filebeat/239443 "2020-07-23T07:19:14Z")
Hello, I send different types of logs from filebeat directly to ES and I have noticed in kibana discover tab that my some logs have empty fields which they are used by other log entries. For example, my production log e… --- ## [Many extra fields displaying after upgrading to 7.8.0](https://discuss.elastic.co/t/many-extra-fields-displaying-after-upgrading-to-7-8-0/237971)
**Author:** [@Ronin](https://discuss.elastic.co/u/Ronin)\ **Replies:** 4\ **Last updated:** [July 23, 2020, 7:17am UTC](https://discuss.elastic.co/t/many-extra-fields-displaying-after-upgrading-to-7-8-0/237971 "2020-07-23T07:17:22Z")
After upgrading the full stack to 7.8.0, Kibana now shows numerous fields in a document that it did not before. These are for the filebeat index and all the extra fields are empty. Looking at the json document inside … --- ## [Last line of log repeatedly gets indexed/processed to elastic/kibana](https://discuss.elastic.co/t/last-line-of-log-repeatedly-gets-indexed-processed-to-elastic-kibana/242293)
**Author:** [@Aj\_t](https://discuss.elastic.co/u/Aj_t)\ **Replies:** 0\ **Last updated:** [July 23, 2020, 7:15am UTC](https://discuss.elastic.co/t/last-line-of-log-repeatedly-gets-indexed-processed-to-elastic-kibana/242293 "2020-07-23T07:15:20Z")
I have a filebeat \> logstash \> elastic set up and I am working with a multi-line log format. I am not sure why the last line of the log file is repeatedly getting indexed. What I would ideally want is that filebeat wo… --- ## [Move Indices from Cold Node to S3-IA](https://discuss.elastic.co/t/move-indices-from-cold-node-to-s3-ia/242197)
**Author:** [@jijo.john](https://discuss.elastic.co/u/jijo.john)\ **Replies:** 4\ **Last updated:** [July 23, 2020, 7:02am UTC](https://discuss.elastic.co/t/move-indices-from-cold-node-to-s3-ia/242197 "2020-07-23T07:02:37Z")
Hi Team, Could you please let us know how we can move only indices from cold node to S3 with a snapshot- restore policy. Is there any option in backup policy to target only a freezed index from cold node to be moved to … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1909) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1911)