# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1997 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1998 --- ## [Message field not available while creating visualization](https://discuss.elastic.co/t/message-field-not-available-while-creating-visualization/237226)
**Author:** [@Mohan\_vel](https://discuss.elastic.co/u/Mohan_vel)\ **Replies:** 0\ **Last updated:** [June 16, 2020, 6:28am UTC](https://discuss.elastic.co/t/message-field-not-available-while-creating-visualization/237226 "2020-06-16T06:28:21Z")
Hi All, Here i am using filebeat to ship all my java application logger file data to elasticsearch using ECS-Logging method for java application. ecs-logging-java: https://github.com/elastic/ecs-logging-java It's worki… --- ## [IOException : Connection reset by peer](https://discuss.elastic.co/t/ioexception-connection-reset-by-peer/237227)
**Author:** [@Bhushan\_Kakulte](https://discuss.elastic.co/u/Bhushan_Kakulte)\ **Replies:** 0\ **Last updated:** [June 16, 2020, 6:44am UTC](https://discuss.elastic.co/t/ioexception-connection-reset-by-peer/237227 "2020-06-16T06:44:35Z")
Hi Guy, I am getting IOException (Connection reset by peer) intermittently while doing search and index query using highEndClient. We didn't figure out any issue at server side. I also tried to tweak with keepAliveTimin… --- ## [Unable to install elastic search-7.6.0 in m6g.4xl instance which contains amazon linux](https://discuss.elastic.co/t/unable-to-install-elastic-search-7-6-0-in-m6g-4xl-instance-which-contains-amazon-linux/237228)
**Author:** [@nchalise](https://discuss.elastic.co/u/nchalise)\ **Replies:** 1\ **Last updated:** [June 16, 2020, 6:48am UTC](https://discuss.elastic.co/t/unable-to-install-elastic-search-7-6-0-in-m6g-4xl-instance-which-contains-amazon-linux/237228 "2020-06-16T06:48:43Z")
Hi, I am unable to found an rpm package for elastic search 7.6.0 to amazon Linux(m6g.4xl instance). When I tried to install another package it shows Error: package elasticsearch-0:7.6.0-1.x86\_64 is intended for a differ… --- ## [Shard unassigned](https://discuss.elastic.co/t/shard-unassigned/237154)
**Author:** [@sahere37](https://discuss.elastic.co/u/sahere37)\ **Replies:** 2\ **Last updated:** [June 16, 2020, 6:42am UTC](https://discuss.elastic.co/t/shard-unassigned/237154 "2020-06-16T06:42:52Z")
Hi all, My elasticsearch cluster health is red. in order to find reason following command has been ran: \`GET \_cluster/allocation/explain { "index" : "mytweetindex", "shard" : 1, "primary" : true,… --- ## [Problem sincedb\_path](https://discuss.elastic.co/t/problem-sincedb-path/237222)
**Author:** [@Youssef\_SBAI](https://discuss.elastic.co/u/Youssef_SBAI)\ **Replies:** 1\ **Last updated:** [June 16, 2020, 6:01am UTC](https://discuss.elastic.co/t/problem-sincedb-path/237222 "2020-06-16T06:01:56Z")
Hello, I use logstash to ingest CSV file in elastic, i have a problem with sincedb\_path input { file { path =\> "/data/volumes/monitoring/logstash/logCtrlM/stock.csv" start\_position =\> "beginning" sincedb\_path =\> "/usr… --- ## [Could not find or load main class Reddy](https://discuss.elastic.co/t/could-not-find-or-load-main-class-reddy/237212)
**Author:** [@ravinder](https://discuss.elastic.co/u/ravinder)\ **Replies:** 4\ **Last updated:** [June 16, 2020, 5:36am UTC](https://discuss.elastic.co/t/could-not-find-or-load-main-class-reddy/237212 "2020-06-16T05:36:05Z")
Hi Team, I tried to elasticsearch and I see below exception. have tried to uninstall elasticsearch and tried again, retried installing java. but still, see the same error I am stuck and couldn't move even an inch, you… --- ## [Ignore\_above setting is not respected](https://discuss.elastic.co/t/ignore-above-setting-is-not-respected/237218)
**Author:** [@Rakesh\_B](https://discuss.elastic.co/u/Rakesh_B)\ **Replies:** 1\ **Last updated:** [June 16, 2020, 5:21am UTC](https://discuss.elastic.co/t/ignore-above-setting-is-not-respected/237218 "2020-06-16T05:21:54Z")
Hi, Setup: Elasticsearch version 7.6.1 We are trying to limit the character length of the field message to 20 but the setting ignore\_above is not respected. I'm following the documentation here - https://www.elastic.c… --- ## [Elasticsearch.service: main process exited, code=exited, status=1/FAILURE](https://discuss.elastic.co/t/elasticsearch-service-main-process-exited-code-exited-status-1-failure/237215)
**Author:** [@bhargav7](https://discuss.elastic.co/u/bhargav7)\ **Replies:** 0\ **Last updated:** [June 16, 2020, 4:54am UTC](https://discuss.elastic.co/t/elasticsearch-service-main-process-exited-code-exited-status-1-failure/237215 "2020-06-16T04:54:31Z")
Kindly help me to relove the issuse, update ELK from 7.5.2 to 7.7.7 after updating facing below error. root@hydelkapp /\]# rpm -Uvh --force elasticsearch-7.7.1-x86\_64.rpm Preparing... #########… --- ## [Need to Split the Value in the Message](https://discuss.elastic.co/t/need-to-split-the-value-in-the-message/237217)
**Author:** [@Prithviraj\_Tantubay](https://discuss.elastic.co/u/Prithviraj_Tantubay)\ **Replies:** 0\ **Last updated:** [June 16, 2020, 5:02am UTC](https://discuss.elastic.co/t/need-to-split-the-value-in-the-message/237217 "2020-06-16T05:02:54Z")
I need help in splitting the value in message field and update the result in the remaining respective fields. I have a row data in .csv file in the following format: "NA","GIXRG051/Genpact/Consultant","5/1/2020 2:10","… --- ## [Suggest search](https://discuss.elastic.co/t/suggest-search/237214)
**Author:** [@guruprasadkk](https://discuss.elastic.co/u/guruprasadkk)\ **Replies:** 0\ **Last updated:** [June 16, 2020, 4:53am UTC](https://discuss.elastic.co/t/suggest-search/237214 "2020-06-16T04:53:46Z")
We are using suggest search to do typeahead search. Is there any way to set the "from" so that we receive the results from given offset, just like we set "from" and "size" in normal queries? --- ## [How to sort by different fields in different indices](https://discuss.elastic.co/t/how-to-sort-by-different-fields-in-different-indices/237065)
**Author:** [@Muna](https://discuss.elastic.co/u/Muna)\ **Replies:** 2\ **Last updated:** [June 16, 2020, 4:40am UTC](https://discuss.elastic.co/t/how-to-sort-by-different-fields-in-different-indices/237065 "2020-06-16T04:40:32Z")
Hi, below is my query . here i want to sort the 'abc\_class' by it's "classId" and also a different sort for another Index. please advise is there any approach to achieve this. --- ## [Share \[1000/1000\] elasticsearch one node](https://discuss.elastic.co/t/share-1000-1000-elasticsearch-one-node/237192)
**Author:** [@nurhambali](https://discuss.elastic.co/u/nurhambali)\ **Replies:** 13\ **Last updated:** [June 16, 2020, 4:34am UTC](https://discuss.elastic.co/t/share-1000-1000-elasticsearch-one-node/237192 "2020-06-16T04:34:25Z")
hi, I am running elasticsearch with one node and currently sahre on the elasticserach 1000/1000 is this what causes elasticserach not to be able to create indexes? is there an idea for the problem that I experienced t… --- ## [Kibana sysV init.d did not start after killed](https://discuss.elastic.co/t/kibana-sysv-init-d-did-not-start-after-killed/236156)
**Author:** [@edisonyang](https://discuss.elastic.co/u/edisonyang)\ **Replies:** 2\ **Last updated:** [June 16, 2020, 3:41am UTC](https://discuss.elastic.co/t/kibana-sysv-init-d-did-not-start-after-killed/236156 "2020-06-16T03:41:26Z")
Hello, I'm trying to run kibana as a service on AWS EC2(Amazon Linux 1) with 1GB RAM. Kibana 6.8.6 Installed by RPM run with SysV init And the problem is when I use the Discover to query large size of data, Kibana w… --- ## [How to reduce segment file number in Elasticsearch?](https://discuss.elastic.co/t/how-to-reduce-segment-file-number-in-elasticsearch/237128)
**Author:** [@fageiguanbing](https://discuss.elastic.co/u/fageiguanbing)\ **Replies:** 5\ **Last updated:** [June 16, 2020, 3:32am UTC](https://discuss.elastic.co/t/how-to-reduce-segment-file-number-in-elasticsearch/237128 "2020-06-16T03:32:04Z")
I want to reduce segments file number. There are too many little segment files in a shard. My settings are over here: { "merge": { "scheduler": { "max\_thread\_count": "1", "max\_merge\_c… --- ## [Get only selected fields in Anomaly detection jobs API](https://discuss.elastic.co/t/get-only-selected-fields-in-anomaly-detection-jobs-api/237200)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 2\ **Last updated:** [June 16, 2020, 1:59am UTC](https://discuss.elastic.co/t/get-only-selected-fields-in-anomaly-detection-jobs-api/237200 "2020-06-16T01:59:43Z")
Hi, I want to retrieve only the value of "job\_id" when I make this query GET \_ml/anomaly\_detectors/ It is posible to use something like "\_source " in the \_search queries to only retrieve the "job\_id"? --- ## [How Do I Aggregate With Percentile Rank Using 2 Bounds Of Values? (+/- 300)](https://discuss.elastic.co/t/how-do-i-aggregate-with-percentile-rank-using-2-bounds-of-values-300/237092)
**Author:** [@Ethan777100](https://discuss.elastic.co/u/Ethan777100)\ **Replies:** 2\ **Last updated:** [June 16, 2020, 1:43am UTC](https://discuss.elastic.co/t/how-do-i-aggregate-with-percentile-rank-using-2-bounds-of-values-300/237092 "2020-06-16T01:43:31Z")
I wish to aggregate my data set using percentile rank to show the % of values that are within +/-300 , grouped by their respective location. Today's percentile rank feature only seems to allow for case where you are … --- ## [Can ELK monitor registry values](https://discuss.elastic.co/t/can-elk-monitor-registry-values/236870)
**Author:** [@Ayesha](https://discuss.elastic.co/u/Ayesha)\ **Replies:** 3\ **Last updated:** [June 16, 2020, 12:57am UTC](https://discuss.elastic.co/t/can-elk-monitor-registry-values/236870 "2020-06-16T00:57:55Z")
Hi I want to know is there a way ELK can monitor security configurations like check registry value every 24 hours and if it is changed then alert? Like compare security configurations to a baseline every few hours? --- ## [X-pack / shield](https://discuss.elastic.co/t/x-pack-shield/237191)
**Author:** [@Jerry\_Hoffmeister](https://discuss.elastic.co/u/Jerry_Hoffmeister)\ **Replies:** 6\ **Last updated:** [June 15, 2020, 11:55pm UTC](https://discuss.elastic.co/t/x-pack-shield/237191 "2020-06-15T23:55:04Z")
Hi, Where can I see clearly which parts of x-pack are free and which require a subscription? We have a subscription but are spinning up a new dev effort and are trying to figure out what we can do at least for now with… --- ## [How to use a logstash pipeline filter in a transform elastic](https://discuss.elastic.co/t/how-to-use-a-logstash-pipeline-filter-in-a-transform-elastic/237194)
**Author:** [@ramiriskis](https://discuss.elastic.co/u/ramiriskis)\ **Replies:** 1\ **Last updated:** [June 15, 2020, 11:42pm UTC](https://discuss.elastic.co/t/how-to-use-a-logstash-pipeline-filter-in-a-transform-elastic/237194 "2020-06-15T23:42:21Z")
Hi, I have a logstash pipeline script of the form input-filter-output. The filter part is a long and convoluted grok expression. This worked great for me before, but now that we have moved to the managed elastic cloud, I… --- ## [Copy documents in another index on creation](https://discuss.elastic.co/t/copy-documents-in-another-index-on-creation/236705)
**Author:** [@gitterhh](https://discuss.elastic.co/u/gitterhh)\ **Replies:** 1\ **Last updated:** [June 15, 2020, 11:39pm UTC](https://discuss.elastic.co/t/copy-documents-in-another-index-on-creation/236705 "2020-06-15T23:39:46Z")
We want to keep track of all the changes of a document, so we want to store all the document versions in separate index. Is there a way when a new document is added or changes to send the entire document in another inde… --- ## [Elasticsearch SLM error](https://discuss.elastic.co/t/elasticsearch-slm-error/236767)
**Author:** [@zil2020](https://discuss.elastic.co/u/zil2020)\ **Replies:** 0\ **Last updated:** [June 11, 2020, 5:54pm UTC](https://discuss.elastic.co/t/elasticsearch-slm-error/236767 "2020-06-11T17:54:38Z")
Hi, I have Elasticsearch 7.7.1 and i want to configure SLM policy with cron schedule that triggers multiple times. In terminal curl -X PUT "localhost:9200/\_slm/policy/nightly-snapshots?pretty" -H 'Content-Type: applic… --- ## [Want to categorize processes and group all the servers running that process together using ELK?](https://discuss.elastic.co/t/want-to-categorize-processes-and-group-all-the-servers-running-that-process-together-using-elk/236823)
**Author:** [@Gurkeerat\_Sondhi](https://discuss.elastic.co/u/Gurkeerat_Sondhi)\ **Replies:** 1\ **Last updated:** [June 15, 2020, 11:24pm UTC](https://discuss.elastic.co/t/want-to-categorize-processes-and-group-all-the-servers-running-that-process-together-using-elk/236823 "2020-06-15T23:24:51Z")
Say if I have an app called X and it is running on 4 servers, I want to group the 4 servers together. --- ## [Index template index-pattern](https://discuss.elastic.co/t/index-template-index-pattern/236864)
**Author:** [@Callonski](https://discuss.elastic.co/u/Callonski)\ **Replies:** 1\ **Last updated:** [June 15, 2020, 11:22pm UTC](https://discuss.elastic.co/t/index-template-index-pattern/236864 "2020-06-15T23:22:10Z")
First time creating an index template and not sure about the syntax. I would like it to apply to every index with suffix -2 How should I write that in index-pattern? \*-2 And another rookie question. Can I apply mappin… --- ## [Audit logging doesn't work for Elasticsearch](https://discuss.elastic.co/t/audit-logging-doesnt-work-for-elasticsearch/236873)
**Author:** [@mokaymakci](https://discuss.elastic.co/u/mokaymakci)\ **Replies:** 1\ **Last updated:** [June 15, 2020, 11:19pm UTC](https://discuss.elastic.co/t/audit-logging-doesnt-work-for-elasticsearch/236873 "2020-06-15T23:19:55Z")
Hello, I'm using Elasticsearch by docker-compose. I've set xpack.security.audit.enabled to true, but there is no audit log in the logs folder, but there are gc.log.\* files. Elastic configuration in my docker-compose fi… --- ## [ILM Warm phase settings](https://discuss.elastic.co/t/ilm-warm-phase-settings/236703)
**Author:** [@Viktor\_Markvardt](https://discuss.elastic.co/u/Viktor_Markvardt)\ **Replies:** 0\ **Last updated:** [June 11, 2020, 12:36pm UTC](https://discuss.elastic.co/t/ilm-warm-phase-settings/236703 "2020-06-11T12:36:57Z")
Hi guys, I created an index lifecycle policy for warm phase, but I can not understand where new documents are? My goal is: move old documents to read-only indexes. Please see details below: PUT \_ilm/policy/ro … --- ## [Functionbeat cant send events with warning \[float\] supports only finite values, but got \[Infinity\]](https://discuss.elastic.co/t/functionbeat-cant-send-events-with-warning-float-supports-only-finite-values-but-got-infinity/236916)
**Author:** [@thiago.dantas](https://discuss.elastic.co/u/thiago.dantas)\ **Replies:** 0\ **Last updated:** [June 12, 2020, 3:43pm UTC](https://discuss.elastic.co/t/functionbeat-cant-send-events-with-warning-float-supports-only-finite-values-but-got-infinity/236916 "2020-06-12T15:43:54Z")
A few of our log group subscriptions seem unable to send events to elasticsearch with the following message 2020-06-12T15:07:36.434Z WARN elasticsearch/client.go:535 Cannot index event publisher.Event{Content:beat.Even… --- ## [Duplicated Logs - Filebeats - Logstash](https://discuss.elastic.co/t/duplicated-logs-filebeats-logstash/236901)
**Author:** [@rechena](https://discuss.elastic.co/u/rechena)\ **Replies:** 0\ **Last updated:** [June 12, 2020, 1:07pm UTC](https://discuss.elastic.co/t/duplicated-logs-filebeats-logstash/236901 "2020-06-12T13:07:03Z")
I think I know what it is, but I wanted to see if anyone tried this and found a solution. I run a website in a shared hosting and because I can't install filebeat but I have ssh access for log checking, I've implemented… --- ## [Elasticsearch join on indexes using SIREN](https://discuss.elastic.co/t/elasticsearch-join-on-indexes-using-siren/237014)
**Author:** [@Lokesh\_Kumar1](https://discuss.elastic.co/u/Lokesh_Kumar1)\ **Replies:** 0\ **Last updated:** [June 14, 2020, 6:38am UTC](https://discuss.elastic.co/t/elasticsearch-join-on-indexes-using-siren/237014 "2020-06-14T06:38:27Z")
Hi All. I hope all well there. :slight\_smile: Guys, Can you please clear the below doubt? As we already know we can't perform the join between two indexes like in the relational database, in NoSQL, it doesn't provide … --- ## [Ingest pipeline dissect processor](https://discuss.elastic.co/t/ingest-pipeline-dissect-processor/237019)
**Author:** [@Ajay\_Singh2](https://discuss.elastic.co/u/Ajay_Singh2)\ **Replies:** 0\ **Last updated:** [June 14, 2020, 10:13am UTC](https://discuss.elastic.co/t/ingest-pipeline-dissect-processor/237019 "2020-06-14T10:13:30Z")
Can i do something like if a log contains a specific text ,then use the specific dissect processor statement, else use another dissect statement { "pipeline" : { "processors" : \[ { "if": { "co… --- ## [Problems enabling authentication to elasticsearch](https://discuss.elastic.co/t/problems-enabling-authentication-to-elasticsearch/236942)
**Author:** [@Rodrigo\_Ceballos](https://discuss.elastic.co/u/Rodrigo_Ceballos)\ **Replies:** 5\ **Last updated:** [June 15, 2020, 10:46pm UTC](https://discuss.elastic.co/t/problems-enabling-authentication-to-elasticsearch/236942 "2020-06-15T22:46:36Z")
Hi. We are new to this tool and enable elastic and kibana, however I have not been able to enable security, to make us register with a user in Kibana. I did the following to enable security: 1.- I stopped Kibana and El… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1996) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1998)