# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1977 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1978 --- ## [Failed to validate incoming join request from node](https://discuss.elastic.co/t/failed-to-validate-incoming-join-request-from-node/238420)
**Author:** [@elk6](https://discuss.elastic.co/u/elk6)\ **Replies:** 0\ **Last updated:** [June 24, 2020, 9:21am UTC](https://discuss.elastic.co/t/failed-to-validate-incoming-join-request-from-node/238420 "2020-06-24T09:21:09Z")
I'm trying to set up a simple master-1 node with data-1 and data-2 but when I look at the log I get this error. All nodes are fresh CentOS 7 machine that can ping each other. For all the cluster I've set: cluster.na… --- ## [Csv Column -\> Splitstring array and -\> Nested Object Problem](https://discuss.elastic.co/t/csv-column-splitstring-array-and-nested-object-problem/237609)
**Author:** [@Bender](https://discuss.elastic.co/u/Bender)\ **Replies:** 3\ **Last updated:** [June 24, 2020, 9:18am UTC](https://discuss.elastic.co/t/csv-column-splitstring-array-and-nested-object-problem/237609 "2020-06-24T09:18:44Z")
Dear Community, iam very new in the logstash and Ruby Environment and i have task that i have to solve. Input is a CSV file and on Column has a String with the following content (content length is dynamic but structure… --- ## [Using filebeat modules in conditions](https://discuss.elastic.co/t/using-filebeat-modules-in-conditions/238388)
**Author:** [@ajhstn](https://discuss.elastic.co/u/ajhstn)\ **Replies:** 1\ **Last updated:** [June 24, 2020, 9:06am UTC](https://discuss.elastic.co/t/using-filebeat-modules-in-conditions/238388 "2020-06-24T09:06:13Z")
Assume i have 3 different systems sending different syslog formats to my server on port 514. Using filebeat, i want to use modules in conditionals. eg. When a message field contains "pa" use the PANW module, but if the… --- ## [Dynamic filebeat index naming](https://discuss.elastic.co/t/dynamic-filebeat-index-naming/238387)
**Author:** [@ajhstn](https://discuss.elastic.co/u/ajhstn)\ **Replies:** 1\ **Last updated:** [June 24, 2020, 9:04am UTC](https://discuss.elastic.co/t/dynamic-filebeat-index-naming/238387 "2020-06-24T09:04:26Z")
Hi - I am using the new(er) Okta and PANW filebeat modules. How do i say "send the okta logs to the okta index and the panw logs to the panw index" I have tried this to create an index based of the fields.event.module … --- ## [Customized decode\_csv\_fields in filebeat](https://discuss.elastic.co/t/customized-decode-csv-fields-in-filebeat/238410)
**Author:** [@job52](https://discuss.elastic.co/u/job52)\ **Replies:** 0\ **Last updated:** [June 24, 2020, 9:03am UTC](https://discuss.elastic.co/t/customized-decode-csv-fields-in-filebeat/238410 "2020-06-24T09:03:51Z")
Hello everyone, I started using filebeat to send logs in csv format to elasticsearch, but I didn't find any way to configure filebeat to tell it where to take the headers of csv files, and I don't want to pass through I… --- ## [Index with additional field taking less space than the same index without it](https://discuss.elastic.co/t/index-with-additional-field-taking-less-space-than-the-same-index-without-it/237815)
**Author:** [@jnioche](https://discuss.elastic.co/u/jnioche)\ **Replies:** 6\ **Last updated:** [June 24, 2020, 8:36am UTC](https://discuss.elastic.co/t/index-with-additional-field-taking-less-space-than-the-same-index-without-it/237815 "2020-06-24T08:36:14Z")
Hi, We have been using a field in a similar way to what the old \_all field used to do. We have a bunch of copy\_to from most of our other fields to copy to that field. I have been trying to measure the impact on disk sp… --- ## [Not Able To Custom Name My Axis In Lens](https://discuss.elastic.co/t/not-able-to-custom-name-my-axis-in-lens/238191)
**Author:** [@Ethan777100](https://discuss.elastic.co/u/Ethan777100)\ **Replies:** 1\ **Last updated:** [June 24, 2020, 8:23am UTC](https://discuss.elastic.co/t/not-able-to-custom-name-my-axis-in-lens/238191 "2020-06-24T08:23:18Z")
For the lens visualization, i am not able to define my own axis name for the horizontal-axis (Y-axis given its horizontal bar graph). Instead, the axis inherits the highest child in order in my side panel. So in this ca… --- ## [Time filter not working in kibaba 7.4 when any one of the shard is down](https://discuss.elastic.co/t/time-filter-not-working-in-kibaba-7-4-when-any-one-of-the-shard-is-down/238365)
**Author:** [@Sundar.rv](https://discuss.elastic.co/u/Sundar.rv)\ **Replies:** 2\ **Last updated:** [June 24, 2020, 8:15am UTC](https://discuss.elastic.co/t/time-filter-not-working-in-kibaba-7-4-when-any-one-of-the-shard-is-down/238365 "2020-06-24T08:15:29Z")
Hi everyone, Currently we are testing our ELK cluster where we have 5 data nodes. Our index are split up in 5 data nodes (5 shards) as the index size is ~45GB. The index is a live one (its getting events from logstash … --- ## [How to split an Index, number\_of\_routing\_shards issue](https://discuss.elastic.co/t/how-to-split-an-index-number-of-routing-shards-issue/238024)
**Author:** [@defalt](https://discuss.elastic.co/u/defalt)\ **Replies:** 3\ **Last updated:** [June 24, 2020, 8:04am UTC](https://discuss.elastic.co/t/how-to-split-an-index-number-of-routing-shards-issue/238024 "2020-06-24T08:04:44Z")
Hi, I want to split my index with 5 shards into 10 or 30 shards. At first I tried it with the \_splitAPI but i get the following result the number of routing shards \[5\] must be a multiple of the target shards \[10\] I tr… --- ## [Elastic Search Indexing](https://discuss.elastic.co/t/elastic-search-indexing/238212)
**Author:** [@vijaya](https://discuss.elastic.co/u/vijaya)\ **Replies:** 8\ **Last updated:** [June 24, 2020, 7:51am UTC](https://discuss.elastic.co/t/elastic-search-indexing/238212 "2020-06-24T07:51:06Z")
Dear Team, How to include aggregations at the time of creating indexing in elastic search. Please help me. Best Regards, Vijaya. --- ## [Kibana - Failed to launch chrome!](https://discuss.elastic.co/t/kibana-failed-to-launch-chrome/238370)
**Author:** [@Roman\_Kagan](https://discuss.elastic.co/u/Roman_Kagan)\ **Replies:** 1\ **Last updated:** [June 24, 2020, 7:37am UTC](https://discuss.elastic.co/t/kibana-failed-to-launch-chrome/238370 "2020-06-24T07:37:45Z")
Hi: I have Ubuntu server, downloaded tar, extracted it and trying to run. Also installed bunch of packages from: https://github.com/puppeteer/puppeteer/blob/main/docs/troubleshooting.md (see "Chrome headless doesn't la… --- ## [Not able to give a different name for Label and Legends in Lens chart Y-axis](https://discuss.elastic.co/t/not-able-to-give-a-different-name-for-label-and-legends-in-lens-chart-y-axis/238386)
**Author:** [@Kavin](https://discuss.elastic.co/u/Kavin)\ **Replies:** 1\ **Last updated:** [June 24, 2020, 7:17am UTC](https://discuss.elastic.co/t/not-able-to-give-a-different-name-for-label-and-legends-in-lens-chart-y-axis/238386 "2020-06-24T07:17:51Z")
I like to have a different name for Y-axis in lens chart. The name I am providing in the label column is being showed for both label and legends. Please guide me where can I change that to have different names. --- ## [Reindex or sciling index](https://discuss.elastic.co/t/reindex-or-sciling-index/238393)
**Author:** [@umay\_fb](https://discuss.elastic.co/u/umay_fb)\ **Replies:** 3\ **Last updated:** [June 24, 2020, 7:11am UTC](https://discuss.elastic.co/t/reindex-or-sciling-index/238393 "2020-06-24T07:11:32Z")
i have one index with size 400GB. its too big so i want slicing it,i do it with reindex to monthly. but i get duplicate hit in index pattern. how to solve it? can i reindex from existing index not copy the data but cut … --- ## [How does must work's for multiple query with in array and in filter if there is null value(for query) then automatically remove that query](https://discuss.elastic.co/t/how-does-must-works-for-multiple-query-with-in-array-and-in-filter-if-there-is-null-value-for-query-then-automatically-remove-that-query/238394)
**Author:** [@akshaybhuradia](https://discuss.elastic.co/u/akshaybhuradia)\ **Replies:** 0\ **Last updated:** [June 24, 2020, 7:06am UTC](https://discuss.elastic.co/t/how-does-must-works-for-multiple-query-with-in-array-and-in-filter-if-there-is-null-value-for-query-then-automatically-remove-that-query/238394 "2020-06-24T07:06:16Z")
{ "query": { "bool":{ "must": \[ {"match" : { "userid" : "001" } }, {"query\_string" : {"fields":\["searchbar\_content"\],"query" : "\*"} } \], "filter":\[ { "terms" : { "tag" : \["tag yesterday"\] } }, … --- ## [Service Elasticsearch failed](https://discuss.elastic.co/t/service-elasticsearch-failed/238286)
**Author:** [@Weathmious](https://discuss.elastic.co/u/Weathmious)\ **Replies:** 4\ **Last updated:** [June 24, 2020, 7:08am UTC](https://discuss.elastic.co/t/service-elasticsearch-failed/238286 "2020-06-24T07:08:17Z")
Hi, Hi want to create a Graylog server. He had an error due to elasticsearch so I removed elasticsearch and then install again. The problem is that elasticsearch.service failed after a few seconds when I start it. I wan… --- ## [Elasticsearch DB backup for last one hour for a particular index](https://discuss.elastic.co/t/elasticsearch-db-backup-for-last-one-hour-for-a-particular-index/238377)
**Author:** [@ad1982](https://discuss.elastic.co/u/ad1982)\ **Replies:** 6\ **Last updated:** [June 24, 2020, 7:04am UTC](https://discuss.elastic.co/t/elasticsearch-db-backup-for-last-one-hour-for-a-particular-index/238377 "2020-06-24T07:04:51Z")
Is there a way to take a backup a particular index for just the last 1 hour ? snapshot doesnt provide the time period option? Any ideas? --- ## [GeoIP Enrichment for private IPs in CIDR form whilst using IIS logs input in filebeat](https://discuss.elastic.co/t/geoip-enrichment-for-private-ips-in-cidr-form-whilst-using-iis-logs-input-in-filebeat/238076)
**Author:** [@philippkahr](https://discuss.elastic.co/u/philippkahr)\ **Replies:** 4\ **Last updated:** [June 24, 2020, 6:57am UTC](https://discuss.elastic.co/t/geoip-enrichment-for-private-ips-in-cidr-form-whilst-using-iis-logs-input-in-filebeat/238076 "2020-06-24T06:57:14Z")
Hi, This is a weird problem I am facing. I am using the IIS logs input for filebeat, which creates an ingest-pipeline in ES, thus I can see that the data leaving filebeat is an unmodified string. I created some add\_fie… --- ## [How to recover when the disk is fault](https://discuss.elastic.co/t/how-to-recover-when-the-disk-is-fault/238357)
**Author:** [@jinjinbari](https://discuss.elastic.co/u/jinjinbari)\ **Replies:** 7\ **Last updated:** [June 24, 2020, 6:48am UTC](https://discuss.elastic.co/t/how-to-recover-when-the-disk-is-fault/238357 "2020-06-24T06:48:30Z")
Hello. My server disk is broken yesterday. I couldn\`t get snapshot, only I have index files. I will make new cluster -\> store old files -\> configure path -\> start. Could I recover if I make new cluster only with inde… --- ## [Kibana Walkthrough](https://discuss.elastic.co/t/kibana-walkthrough/238392)
**Author:** [@Shikhar\_Dixit](https://discuss.elastic.co/u/Shikhar_Dixit)\ **Replies:** 4\ **Last updated:** [June 24, 2020, 6:46am UTC](https://discuss.elastic.co/t/kibana-walkthrough/238392 "2020-06-24T06:46:19Z")
Hi, Is there a feature in kibana that allows us to create a walkthrough for kibana using some mock data, to explain some specific features and their usage? --- ## [Problem with logstash: java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit](https://discuss.elastic.co/t/problem-with-logstash-java-lang-illegalstateexception-logstash-stopped-processing-because-of-an-error-systemexit-exit/238390)
**Author:** [@kase](https://discuss.elastic.co/u/kase)\ **Replies:** 1\ **Last updated:** [June 24, 2020, 6:29am UTC](https://discuss.elastic.co/t/problem-with-logstash-java-lang-illegalstateexception-logstash-stopped-processing-because-of-an-error-systemexit-exit/238390 "2020-06-24T06:29:53Z")
Hi there, I'm using elastiflow with logstash, I've done these command in this url(https://www.catapultsystems.com/blogs/install-elastiflow-on-ubuntu-18-04-part-3/) And netflow data could came through logstash to elasti… --- ## [How to connect to 32-bit Sybase from Logstash Windows](https://discuss.elastic.co/t/how-to-connect-to-32-bit-sybase-from-logstash-windows/238389)
**Author:** [@qkhanhpro](https://discuss.elastic.co/u/qkhanhpro)\ **Replies:** 0\ **Last updated:** [June 24, 2020, 6:14am UTC](https://discuss.elastic.co/t/how-to-connect-to-32-bit-sybase-from-logstash-windows/238389 "2020-06-24T06:14:07Z")
Hi. I am trying to push some data from 32-bit Sybase to ES but at the moment, using Logstash for Windows, I am not sure which kind of configuration I should use for this to work? I already have a some experience with L… --- ## [I can't add a new node to my cluster](https://discuss.elastic.co/t/i-cant-add-a-new-node-to-my-cluster/238250)
**Author:** [@dferez](https://discuss.elastic.co/u/dferez)\ **Replies:** 5\ **Last updated:** [June 24, 2020, 6:08am UTC](https://discuss.elastic.co/t/i-cant-add-a-new-node-to-my-cluster/238250 "2020-06-24T06:08:31Z")
Hi. I currently have a two node cluster, each node is separated on a different host. I want to add a third node to the cluster, but it does not start, it has never started. Next I leave the configuration of the nodes: N… --- ## [Where does the export saved Object API put the exported objects?](https://discuss.elastic.co/t/where-does-the-export-saved-object-api-put-the-exported-objects/238378)
**Author:** [@mykael](https://discuss.elastic.co/u/mykael)\ **Replies:** 3\ **Last updated:** [June 24, 2020, 6:00am UTC](https://discuss.elastic.co/t/where-does-the-export-saved-object-api-put-the-exported-objects/238378 "2020-06-24T06:00:39Z")
OK, used curl to drive the saved object export api: curl -X POST "localhost:9200/api/saved\_objects/\_export" -H "kbn-xsrf: true" -H "Content-Type: application/json" -d "{ \\"objects\\": \[ { \\"type\\": \\"dashboard\\" } \], \\"i… --- ## [Querying limited nested data (However nested type is deprecated in 7.x)](https://discuss.elastic.co/t/querying-limited-nested-data-however-nested-type-is-deprecated-in-7-x/238329)
**Author:** [@emmm-dee](https://discuss.elastic.co/u/emmm-dee)\ **Replies:** 6\ **Last updated:** [June 24, 2020, 5:54am UTC](https://discuss.elastic.co/t/querying-limited-nested-data-however-nested-type-is-deprecated-in-7-x/238329 "2020-06-24T05:54:35Z")
Elasticsearch 7.7 and I'm using the official php client to interact with the server. My issue was somewhat solved here: Need to return part of a doc from a search query/filter; is parent-child the way to go? - #2 by xa… --- ## [Drill down graph by clicking on a part of the graph](https://discuss.elastic.co/t/drill-down-graph-by-clicking-on-a-part-of-the-graph/238180)
**Author:** [@TUSHAR\_Sinha](https://discuss.elastic.co/u/TUSHAR_Sinha)\ **Replies:** 5\ **Last updated:** [June 24, 2020, 5:51am UTC](https://discuss.elastic.co/t/drill-down-graph-by-clicking-on-a-part-of-the-graph/238180 "2020-06-24T05:51:42Z")
Hi all, I want to create a drill down graph like, if I have a horizontal bar graph and if I click on any of the bar a new graph should be drilled out with the data related to that bar only. Is it possible to do so? --- ## [How to take snapshot for four different indices through curator](https://discuss.elastic.co/t/how-to-take-snapshot-for-four-different-indices-through-curator/238262)
**Author:** [@gokulnath112](https://discuss.elastic.co/u/gokulnath112)\ **Replies:** 2\ **Last updated:** [June 24, 2020, 5:38am UTC](https://discuss.elastic.co/t/how-to-take-snapshot-for-four-different-indices-through-curator/238262 "2020-06-24T05:38:01Z")
Hi Everyone.. Greetings...! I want to write a curator job to take 4 indices backup. But the all indices name are not starts with same word.(all are having different names) . In other case i have another set of indices … --- ## [Master not discovered or elected yet, an election requires 2 nodes with ids](https://discuss.elastic.co/t/master-not-discovered-or-elected-yet-an-election-requires-2-nodes-with-ids/237986)
**Author:** [@poetL](https://discuss.elastic.co/u/poetL)\ **Replies:** 2\ **Last updated:** [June 24, 2020, 5:27am UTC](https://discuss.elastic.co/t/master-not-discovered-or-elected-yet-an-election-requires-2-nodes-with-ids/237986 "2020-06-24T05:27:09Z")
I have three node clusters, one of which is a master node. The master node has been lost and there are only two slave nodes at present. However, after I rejoin the new master node, it cannot work properly \[node33\] maste… --- ## [Get count of top-level deleted documents in Elasticsearch](https://discuss.elastic.co/t/get-count-of-top-level-deleted-documents-in-elasticsearch/238371)
**Author:** [@kailoofi](https://discuss.elastic.co/u/kailoofi)\ **Replies:** 1\ **Last updated:** [June 24, 2020, 5:24am UTC](https://discuss.elastic.co/t/get-count-of-top-level-deleted-documents-in-elasticsearch/238371 "2020-06-24T05:24:35Z")
I am looking to get an accurate count of deleted Elasticsearch documents excluding the nested documents at Lucene level. I am aware of the following APIs to get document and deleted document counts but none of them retur… --- ## [io.netty.handler.codec.DecoderException: javax.net.ssl.SSLException: Session has no PSK](https://discuss.elastic.co/t/io-netty-handler-codec-decoderexception-javax-net-ssl-sslexception-session-has-no-psk/233722)
**Author:** [@rahul\_s](https://discuss.elastic.co/u/rahul_s)\ **Replies:** 5\ **Last updated:** [June 24, 2020, 5:22am UTC](https://discuss.elastic.co/t/io-netty-handler-codec-decoderexception-javax-net-ssl-sslexception-session-has-no-psk/233722 "2020-06-24T05:22:05Z")
Using Elasticsearch 7.6.1 with SSL enabled we noticed the following error being logged in Elasticsearch logs \[WARN \]\[o.e.h.AbstractHttpServerTransport\] \[host\] caught exception while handling client http traffic, closing… --- ## [How to connect API with Search UI](https://discuss.elastic.co/t/how-to-connect-api-with-search-ui/237970)
**Author:** [@spadel](https://discuss.elastic.co/u/spadel)\ **Replies:** 1\ **Last updated:** [June 24, 2020, 5:07am UTC](https://discuss.elastic.co/t/how-to-connect-api-with-search-ui/237970 "2020-06-24T05:07:50Z")
I have an API with Flask, that runs on my localhost. Basically, I have a search box, where I can enter any sentence. Furthermore I have a database with sentences (in my case an excel sheet). Through some neural network, … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1976) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1978)