# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=230 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 231 --- ## [My Elasticsearch Got Killed Frequently due to OOM killer with Out of memory message](https://discuss.elastic.co/t/my-elasticsearch-got-killed-frequently-due-to-oom-killer-with-out-of-memory-message/360421)
**Author:** [@bbkunbi](https://discuss.elastic.co/u/bbkunbi)\ **Replies:** 7\ **Last updated:** [May 29, 2024, 11:10am UTC](https://discuss.elastic.co/t/my-elasticsearch-got-killed-frequently-due-to-oom-killer-with-out-of-memory-message/360421 "2024-05-29T11:10:10Z")
My Syslog message is: Out of memory: Killed process 1421927 (java) total-vm:17109192kB, anon-rss:6968532kB, file-rss:0kB, shmem-rss:0kB, UID:128 pgtables:18984kB oom\_score\_adj In which file i need to define memory: -r… --- ## [Visutalization to Canvas](https://discuss.elastic.co/t/visutalization-to-canvas/359617)
**Author:** [@Emilio\_Astier](https://discuss.elastic.co/u/Emilio_Astier)\ **Replies:** 2\ **Last updated:** [May 29, 2024, 11:09am UTC](https://discuss.elastic.co/t/visutalization-to-canvas/359617 "2024-05-29T11:09:46Z")
Hello I want to pass a kibana visualization of type bars to Canvas. Is there a tutorial to do this? or it is necessary to construct an SQL statement. Any help welcome. Thanks and regards Emilio --- ## [Best pagination approach for a REST Api that fetches logs from Elastic](https://discuss.elastic.co/t/best-pagination-approach-for-a-rest-api-that-fetches-logs-from-elastic/360447)
**Author:** [@Moni\_Hazarika](https://discuss.elastic.co/u/Moni_Hazarika)\ **Replies:** 0\ **Last updated:** [May 29, 2024, 10:46am UTC](https://discuss.elastic.co/t/best-pagination-approach-for-a-rest-api-that-fetches-logs-from-elastic/360447 "2024-05-29T10:46:29Z")
If I have all my application logs being pushed to Elastic via Filebeats -\> Logstash pipeline.We have a facing public API where customers can call this API 24\*7 to fetch the logs. Currently our api takes these optional qu… --- ## [Filebeat send snippet of xml](https://discuss.elastic.co/t/filebeat-send-snippet-of-xml/360364)
**Author:** [@Keldane](https://discuss.elastic.co/u/Keldane)\ **Replies:** 7\ **Last updated:** [May 29, 2024, 10:22am UTC](https://discuss.elastic.co/t/filebeat-send-snippet-of-xml/360364 "2024-05-29T10:22:40Z")
Hey! im a new in ELK stack, and I have a issue trying to send a xml to Logstash. The xml I want to send is more than 280k lines, but im only interested in send from one xpath to the end of the file. How should I config… --- ## [Unable to access elasticsearch on localhost:9200](https://discuss.elastic.co/t/unable-to-access-elasticsearch-on-localhost-9200/360368)
**Author:** [@Lim\_Rik](https://discuss.elastic.co/u/Lim_Rik)\ **Replies:** 6\ **Last updated:** [May 29, 2024, 10:15am UTC](https://discuss.elastic.co/t/unable-to-access-elasticsearch-on-localhost-9200/360368 "2024-05-29T10:15:16Z")
I am trying to run elasticsearch on docker, I am able to get my images up but unable to access localhost:9200, I am able to access kibana on localhost:5601 though. --- ## [Kibana - Enterprise Search Connector Issue](https://discuss.elastic.co/t/kibana-enterprise-search-connector-issue/360248)
**Author:** [@longansoju](https://discuss.elastic.co/u/longansoju)\ **Replies:** 15\ **Last updated:** [May 29, 2024, 10:10am UTC](https://discuss.elastic.co/t/kibana-enterprise-search-connector-issue/360248 "2024-05-29T10:10:11Z")
Hi All, I was trying to migrate my connector configurations over from my testing environment into my live environment. However, every single time i enter the configuration page of my connector, it prompts the error "An u… --- ## [S3-repository-path-is-not-accessible-on-master-node](https://discuss.elastic.co/t/s3-repository-path-is-not-accessible-on-master-node/360438)
**Author:** [@saikatkonar](https://discuss.elastic.co/u/saikatkonar)\ **Replies:** 0\ **Last updated:** [May 29, 2024, 8:30am UTC](https://discuss.elastic.co/t/s3-repository-path-is-not-accessible-on-master-node/360438 "2024-05-29T08:30:02Z")
We are using 3 node cluster and we installed the repository-s3 plugin on all the 3 nodes, the ES is running in EKS cluster. We have given permission using IAM role and assigned the same using service account. When I go i… --- ## ["Server Authentication using apikey failed - unable to find apikey with id id"](https://discuss.elastic.co/t/server-authentication-using-apikey-failed-unable-to-find-apikey-with-id-id/360413)
**Author:** [@ski](https://discuss.elastic.co/u/ski)\ **Replies:** 0\ **Last updated:** [May 28, 2024, 9:00pm UTC](https://discuss.elastic.co/t/server-authentication-using-apikey-failed-unable-to-find-apikey-with-id-id/360413 "2024-05-28T21:00:10Z")
Good day. I currently operate a single node air-gapped configuration of Elasticsearch & Kibana (Version 8.13). As soon as the cluster is booted up, we receive the following error basically Every minute with an unspecifie… --- ## [Date filter results in empty documents and no error in logs](https://discuss.elastic.co/t/date-filter-results-in-empty-documents-and-no-error-in-logs/360397)
**Author:** [@bvoros](https://discuss.elastic.co/u/bvoros)\ **Replies:** 3\ **Last updated:** [May 29, 2024, 8:22am UTC](https://discuss.elastic.co/t/date-filter-results-in-empty-documents-and-no-error-in-logs/360397 "2024-05-29T08:22:42Z")
Hello, I am trying to apply the date filter against data that has been created by the json filter, the relevant field gets placed into \[data\]\[timestamp\] in text format, when the following filter is applied, logstash kee… --- ## [percentage by row not overall](https://discuss.elastic.co/t/percentage-by-row-not-overall/360239)
**Author:** [@Ahmed2](https://discuss.elastic.co/u/Ahmed2)\ **Replies:** 3\ **Last updated:** [May 29, 2024, 8:22am UTC](https://discuss.elastic.co/t/percentage-by-row-not-overall/360239 "2024-05-29T08:22:30Z")
I am using metric visualization type in kibana. In Metric section, I have used 'count' aggregation and in bucket section, i have used 'terms' aggregation with field 'executionStatus.keyword' and clicked on 'update' butto… --- ## [Function score query returned an invalid score -1.475 for doc: 0](https://discuss.elastic.co/t/function-score-query-returned-an-invalid-score-1-475-for-doc-0/360434)
**Author:** [@atombrownbear](https://discuss.elastic.co/u/atombrownbear)\ **Replies:** 0\ **Last updated:** [May 29, 2024, 7:22am UTC](https://discuss.elastic.co/t/function-score-query-returned-an-invalid-score-1-475-for-doc-0/360434 "2024-05-29T07:22:57Z")
Hi all! sometimes the error {"type":"exception","reason":"function score query returned an invalid score: -1.4750118 for doc: 0"} appears. I don't understand what is doc:0 , because all the documents in my index ha… --- ## [How to backup only the configuration of the cluster](https://discuss.elastic.co/t/how-to-backup-only-the-configuration-of-the-cluster/360433)
**Author:** [@mbby](https://discuss.elastic.co/u/mbby)\ **Replies:** 0\ **Last updated:** [May 29, 2024, 6:54am UTC](https://discuss.elastic.co/t/how-to-backup-only-the-configuration-of-the-cluster/360433 "2024-05-29T06:54:06Z")
Hi, I want to create a backup of the config of my cluster (users, index mappings, beats config, kibana, ...). I know that I need to backup the /etc directories and that Elasticsearch stores a huge amount of config data … --- ## [Reverse order of recovery of indexes](https://discuss.elastic.co/t/reverse-order-of-recovery-of-indexes/360429)
**Author:** [@SHASHANK\_AGRAWAL1](https://discuss.elastic.co/u/SHASHANK_AGRAWAL1)\ **Replies:** 1\ **Last updated:** [May 29, 2024, 6:23am UTC](https://discuss.elastic.co/t/reverse-order-of-recovery-of-indexes/360429 "2024-05-29T06:23:05Z")
Index recovery prioritization This states that newer indexes are recovered first if priority is not set, by default. Is there any setting to revert this order. I want older indices to be recovered first. --- ## [Massive index creation after conditional indexing](https://discuss.elastic.co/t/massive-index-creation-after-conditional-indexing/360342)
**Author:** [@Samuel\_Ruiz\_Garcia](https://discuss.elastic.co/u/Samuel_Ruiz_Garcia)\ **Replies:** 2\ **Last updated:** [May 29, 2024, 6:09am UTC](https://discuss.elastic.co/t/massive-index-creation-after-conditional-indexing/360342 "2024-05-29T06:09:57Z")
We have a server, where we had previously configured a filebeat for a simple monitoring of log files. A month ago we were asked to ingest the record of a containered docker application, but this had to be recorded in a s… --- ## [Is there any problem with compatibility...?](https://discuss.elastic.co/t/is-there-any-problem-with-compatibility/360426)
**Author:** [@seho1021](https://discuss.elastic.co/u/seho1021)\ **Replies:** 1\ **Last updated:** [May 29, 2024, 5:51am UTC](https://discuss.elastic.co/t/is-there-any-problem-with-compatibility/360426 "2024-05-29T05:51:48Z")
We are using Elasticsearch 6.5.2 + Kibana 6.5.2 in Ubuntu 18.04. Among them, even if you upgrade the Ubuntu version to 20.04 Is there any effect on the use of Ubuntu 20.04 + Elasticsearch 6.5.2 + Kibana 6.5.2 ...? ( S… --- ## [Cannot read existing Message Signing Key pair for all integrations and fleet actions](https://discuss.elastic.co/t/cannot-read-existing-message-signing-key-pair-for-all-integrations-and-fleet-actions/360205)
**Author:** [@mealbert23](https://discuss.elastic.co/u/mealbert23)\ **Replies:** 6\ **Last updated:** [May 28, 2024, 8:35pm UTC](https://discuss.elastic.co/t/cannot-read-existing-message-signing-key-pair-for-all-integrations-and-fleet-actions/360205 "2024-05-28T20:35:51Z")
Hi, I have deployed Elasticsearch and Kibana on a aws eks cluster by mostly following the quickstart guide for elastic cloud on kubernetes. I was able to get both elasticsearch and kibana running but know I want to set… --- ## [Rolling upgrade exception denying access as action on internal](https://discuss.elastic.co/t/rolling-upgrade-exception-denying-access-as-action-on-internal/360399)
**Author:** [@ctluce](https://discuss.elastic.co/u/ctluce)\ **Replies:** 0\ **Last updated:** [May 28, 2024, 4:15pm UTC](https://discuss.elastic.co/t/rolling-upgrade-exception-denying-access-as-action-on-internal/360399 "2024-05-28T16:15:02Z")
During a rolling upgrade running into denying access as action \[internal:cluster/coordination/join/validate\] is not an index or cluster action. I'm trying to figure out what is causing this and if any way forward. I hav… --- ## [Winlogbeat - multiple event\_id's and processor drop\_events](https://discuss.elastic.co/t/winlogbeat-multiple-event-ids-and-processor-drop-events/360392)
**Author:** [@tandav](https://discuss.elastic.co/u/tandav)\ **Replies:** 2\ **Last updated:** [May 28, 2024, 4:02pm UTC](https://discuss.elastic.co/t/winlogbeat-multiple-event-ids-and-processor-drop-events/360392 "2024-05-28T16:02:08Z")
Running version 7.17.21, but I cannot seem to get this working. What I am trying to do is if event\_id is xxxx than drop event that matches a regex, but if event\_id is not xxxx than drop events that matches a different r… --- ## [Create a query to obtain a user's average between two dates](https://discuss.elastic.co/t/create-a-query-to-obtain-a-users-average-between-two-dates/360389)
**Author:** [@Melman](https://discuss.elastic.co/u/Melman)\ **Replies:** 0\ **Last updated:** [May 28, 2024, 2:52pm UTC](https://discuss.elastic.co/t/create-a-query-to-obtain-a-users-average-between-two-dates/360389 "2024-05-28T14:52:57Z")
Hello everyone, I'm looking to create a rule that will allow me to obtain the average of a date between two dates. For example, a user usually generates logs between 8am and 6pm. I've tried an approach with ES|QL but I… --- ## [/usr/local/bin/docker-entrypoint: line 8: /usr/share/heartbeat/heartbeat: Operation not permitted](https://discuss.elastic.co/t/usr-local-bin-docker-entrypoint-line-8-usr-share-heartbeat-heartbeat-operation-not-permitted/357119)
**Author:** [@WookWook](https://discuss.elastic.co/u/WookWook)\ **Replies:** 3\ **Last updated:** [May 28, 2024, 2:30pm UTC](https://discuss.elastic.co/t/usr-local-bin-docker-entrypoint-line-8-usr-share-heartbeat-heartbeat-operation-not-permitted/357119 "2024-05-28T14:30:54Z")
Hi, we are are running Elastic Cloud on Kubernetes 2.11 in an Openshift 4.12 environment. All images use version 8.12.1 I am having issues to get heatbeat running. I followed the Elastic Docs Created a service accoun… --- ## [How to configure mapping of nested properties using .NET client?](https://discuss.elastic.co/t/how-to-configure-mapping-of-nested-properties-using-net-client/360317)
**Author:** [@JornWildt](https://discuss.elastic.co/u/JornWildt)\ **Replies:** 4\ **Last updated:** [May 28, 2024, 1:40pm UTC](https://discuss.elastic.co/t/how-to-configure-mapping-of-nested-properties-using-net-client/360317 "2024-05-28T13:40:14Z")
I am trying to map a graph using the .NET Client API from NuGet "Elastic.Clients.Elasticsearch" 8.13.8. See code below. The graph nodes are each represented as a document in ES. On each document there is supposed to be … --- ## [Setting up remote sites with separate Fleet servers](https://discuss.elastic.co/t/setting-up-remote-sites-with-separate-fleet-servers/360379)
**Author:** [@fhegedus](https://discuss.elastic.co/u/fhegedus)\ **Replies:** 0\ **Last updated:** [May 28, 2024, 1:33pm UTC](https://discuss.elastic.co/t/setting-up-remote-sites-with-separate-fleet-servers/360379 "2024-05-28T13:33:28Z")
Dear Community, I’m deploying Elastic Stack on one main (local) site and two remote sites. Each site has an Elastic cluster with 3 Elasticsearch nodes. Each site has a Fleet server deployed but only the main (local) sit… --- ## [Managed ELK || Basic Edition || Alert](https://discuss.elastic.co/t/managed-elk-basic-edition-alert/360343)
**Author:** [@Yogesh\_AS](https://discuss.elastic.co/u/Yogesh_AS)\ **Replies:** 6\ **Last updated:** [May 28, 2024, 1:28pm UTC](https://discuss.elastic.co/t/managed-elk-basic-edition-alert/360343 "2024-05-28T13:28:18Z")
Hi Team , Is there any way to get the out of box alerts for basic license of managed elk environment without configuring the alerts manually. Thanks in advance !!! --- ## [Can't read jounrald logs set within a folder about beats' input -\> paths](https://discuss.elastic.co/t/cant-read-jounrald-logs-set-within-a-folder-about-beats-input-paths/359759)
**Author:** [@huanghaiqing1](https://discuss.elastic.co/u/huanghaiqing1)\ **Replies:** 16\ **Last updated:** [May 28, 2024, 12:30pm UTC](https://discuss.elastic.co/t/cant-read-jounrald-logs-set-within-a-folder-about-beats-input-paths/359759 "2024-05-28T12:30:49Z")
Here we setup a journald log server and set a folder as filebeat's input paths. The output is elasticsearch. But filebeat can't crawl every jounal files within that folder. When we clearly define each journal file's path… --- ## [Search data with special characters](https://discuss.elastic.co/t/search-data-with-special-characters/360285)
**Author:** [@Adrian\_Cuesta](https://discuss.elastic.co/u/Adrian_Cuesta)\ **Replies:** 2\ **Last updated:** [May 28, 2024, 12:26pm UTC](https://discuss.elastic.co/t/search-data-with-special-characters/360285 "2024-05-28T12:26:44Z")
Hi! I have a problem with getting data with special characters like -,+,% i have and index and my fields are like this: "productSacCode": { "type": "text" } "productShortDescription": { "fielddata": true, "ty… --- ## [Today date data is coming into previous index](https://discuss.elastic.co/t/today-date-data-is-coming-into-previous-index/360312)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 2\ **Last updated:** [May 28, 2024, 12:26pm UTC](https://discuss.elastic.co/t/today-date-data-is-coming-into-previous-index/360312 "2024-05-28T12:26:02Z")
Hi Community, We have DC-DR(Active Active)ELK cluster running. We have Observed that for 2024-05-25 00:00-23:59 time range in discover if i select \_index i am seeing index-2024-05-27. For Replication from DC to DR we ar… --- ## [Elasticsearch Internal URl](https://discuss.elastic.co/t/elasticsearch-internal-url/360376)
**Author:** [@dfir](https://discuss.elastic.co/u/dfir)\ **Replies:** 0\ **Last updated:** [May 28, 2024, 12:22pm UTC](https://discuss.elastic.co/t/elasticsearch-internal-url/360376 "2024-05-28T12:22:12Z")
I am hosting Elasticsearch internally on a VM. I want to allow others to login to Kibana. What is the correct setting? Are there changes required to kibana.yml, elasticsearch.yml or both? --- ## [Parameter index on type dense\_vector deprecation log](https://discuss.elastic.co/t/parameter-index-on-type-dense-vector-deprecation-log/360116)
**Author:** [@ol\_minhkhau](https://discuss.elastic.co/u/ol_minhkhau)\ **Replies:** 3\ **Last updated:** [May 28, 2024, 12:15pm UTC](https://discuss.elastic.co/t/parameter-index-on-type-dense-vector-deprecation-log/360116 "2024-05-28T12:15:15Z")
I have a dynamic template with the mapping like this "mapping": { "type": "dense\_vector", "dims": 42, "index": false } And I receive this deprecation log: Parameter \[index\] has no effect on type \[dense\_vector\] and wil… --- ## [Why i can't connect heartbeat to elasticsearch?](https://discuss.elastic.co/t/why-i-cant-connect-heartbeat-to-elasticsearch/360327)
**Author:** [@eructro](https://discuss.elastic.co/u/eructro)\ **Replies:** 3\ **Last updated:** [May 28, 2024, 11:36am UTC](https://discuss.elastic.co/t/why-i-cant-connect-heartbeat-to-elasticsearch/360327 "2024-05-28T11:36:06Z")
There is a problem when i want to connect heartbeat to elasticsearch. I already config on heartbeat.yml in the correct way. I also input ca fingerprint from elasticsearch. Anyone can figure out my problem? --- ## [The cluster is not working](https://discuss.elastic.co/t/the-cluster-is-not-working/359880)
**Author:** [@ascalonking](https://discuss.elastic.co/u/ascalonking)\ **Replies:** 7\ **Last updated:** [May 28, 2024, 10:32am UTC](https://discuss.elastic.co/t/the-cluster-is-not-working/359880 "2024-05-28T10:32:02Z")
I can't start the elasticsearch cluster elasticsearch.yml # ======================== Elasticsearch Configuration ========================= # # NOTE: Elasticsearch comes with reasonable defaults for most settings. # … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=229) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=231)