# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=248 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 249 --- ## [Retention lease background sync failed - help understand this log](https://discuss.elastic.co/t/retention-lease-background-sync-failed-help-understand-this-log/358334)
**Author:** [@Vikram\_R](https://discuss.elastic.co/u/Vikram_R)\ **Replies:** 10\ **Last updated:** [May 6, 2024, 7:32am UTC](https://discuss.elastic.co/t/retention-lease-background-sync-failed-help-understand-this-log/358334 "2024-05-06T07:32:10Z")
Hi Guys, New to this technology, I've tried to use elasticsearch self-managed for our application in our organization. I'm facing this "retention lease background sync failed" issue for quite some time. I tried to get… --- ## [Question in Node Configuration](https://discuss.elastic.co/t/question-in-node-configuration/358782)
**Author:** [@hossa](https://discuss.elastic.co/u/hossa)\ **Replies:** 1\ **Last updated:** [May 6, 2024, 7:31am UTC](https://discuss.elastic.co/t/question-in-node-configuration/358782 "2024-05-06T07:31:49Z")
Hello I have a cluster consisting of 3 nodes, one of which I want to be for reading and the other for writing How can I do that? --- ## [My filebeat may encounter garbled code issues when collecting colored logs](https://discuss.elastic.co/t/my-filebeat-may-encounter-garbled-code-issues-when-collecting-colored-logs/358785)
**Author:** [@SolaiP1](https://discuss.elastic.co/u/SolaiP1)\ **Replies:** 0\ **Last updated:** [May 6, 2024, 7:13am UTC](https://discuss.elastic.co/t/my-filebeat-may-encounter-garbled-code-issues-when-collecting-colored-logs/358785 "2024-05-06T07:13:13Z")
Will filebeat garbled when collecting logs with desired colors? --- ## [Using Anomaly Detection in Watcher Threshold Setting](https://discuss.elastic.co/t/using-anomaly-detection-in-watcher-threshold-setting/358288)
**Author:** [@A\_Espiritu](https://discuss.elastic.co/u/A_Espiritu)\ **Replies:** 1\ **Last updated:** [May 6, 2024, 7:04am UTC](https://discuss.elastic.co/t/using-anomaly-detection-in-watcher-threshold-setting/358288 "2024-05-06T07:04:14Z")
Hi all, I am doing a POC right now - still starting out exploring Elastic so apologies if some questions are too basic. We currently have a dashboard that counts the number of incidents per day. They've also implement… --- ## [Is number of CPU defines number of workers in logstash?](https://discuss.elastic.co/t/is-number-of-cpu-defines-number-of-workers-in-logstash/358756)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 3\ **Last updated:** [May 5, 2024, 3:46pm UTC](https://discuss.elastic.co/t/is-number-of-cpu-defines-number-of-workers-in-logstash/358756 "2024-05-05T15:46:56Z")
In our logstash server 6 CPUs we have. Is this implies pipeline.worker value can be set to 6 ? --- ## [Text\_embedding configured for model but rejected for query](https://discuss.elastic.co/t/text-embedding-configured-for-model-but-rejected-for-query/357163)
**Author:** [@wnmills3](https://discuss.elastic.co/u/wnmills3)\ **Replies:** 8\ **Last updated:** [May 5, 2024, 6:45pm UTC](https://discuss.elastic.co/t/text-embedding-configured-for-model-but-rejected-for-query/357163 "2024-05-05T18:45:50Z")
I have issued a query like below: { "query": { "bool": { "should": \[ { "text\_embedding": { "path\_embedding.tokens": { … --- ## [Need help / sample code snippet to implement the typescript react code to connect to elastic-search server to push data to index](https://discuss.elastic.co/t/need-help-sample-code-snippet-to-implement-the-typescript-react-code-to-connect-to-elastic-search-server-to-push-data-to-index/358762)
**Author:** [@Sunil\_Jagtap](https://discuss.elastic.co/u/Sunil_Jagtap)\ **Replies:** 0\ **Last updated:** [May 5, 2024, 6:29pm UTC](https://discuss.elastic.co/t/need-help-sample-code-snippet-to-implement-the-typescript-react-code-to-connect-to-elastic-search-server-to-push-data-to-index/358762 "2024-05-05T18:29:33Z")
Need help / sample code snippet to implement the typescript react code to connect to elastic-search server to push data to index from kibana running on local, This may need to bypass proxy & SSL certificate. Below code … --- ## [AWS S3 logs --\> SQS --\> ELastic search](https://discuss.elastic.co/t/aws-s3-logs-sqs-elastic-search/358749)
**Author:** [@Niel.devops](https://discuss.elastic.co/u/Niel.devops)\ **Replies:** 3\ **Last updated:** [May 5, 2024, 2:58pm UTC](https://discuss.elastic.co/t/aws-s3-logs-sqs-elastic-search/358749 "2024-05-05T14:58:11Z")
Hi Guys, we can see that the performance of sending logs from S3 --\> Elastic SIEM is low compared to SQS. Elastic is doing enhancements in uploading data from S3 --\> SIEM directly. However, I created a Lambda function su… --- ## [Sharding Strategy when data is in Tb](https://discuss.elastic.co/t/sharding-strategy-when-data-is-in-tb/358741)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 6\ **Last updated:** [May 5, 2024, 8:08am UTC](https://discuss.elastic.co/t/sharding-strategy-when-data-is-in-tb/358741 "2024-05-05T08:08:51Z")
Hi Community I have a cluster of 13 nodes Six Hot nodes each with 32gb heap memory , 6tb SSD Storage, 9 CPU , RAM 125gb . Three Master nodes 32gb Heap Size , 3 CPU , 50gb Storage Three Warm nodes each with 15t… --- ## [If translog durability is set to request, then flush is required?](https://discuss.elastic.co/t/if-translog-durability-is-set-to-request-then-flush-is-required/358687)
**Author:** [@Amit\_Shukla](https://discuss.elastic.co/u/Amit_Shukla)\ **Replies:** 13\ **Last updated:** [May 5, 2024, 6:48am UTC](https://discuss.elastic.co/t/if-translog-durability-is-set-to-request-then-flush-is-required/358687 "2024-05-05T06:48:26Z")
Talking about Elasticsearch version 7.17 This is regarding how flush API and index.translog.durability settings are connected to each other. My understanding is that if this index.translog.durability is set as Request … --- ## [Data Validation for data node after rolling restart](https://discuss.elastic.co/t/data-validation-for-data-node-after-rolling-restart/358739)
**Author:** [@Amit\_Shukla](https://discuss.elastic.co/u/Amit_Shukla)\ **Replies:** 1\ **Last updated:** [May 4, 2024, 5:14pm UTC](https://discuss.elastic.co/t/data-validation-for-data-node-after-rolling-restart/358739 "2024-05-04T17:14:55Z")
Context: We are updating OS four Elasticsearch cluster and in that process we are taking out each data node one by one and then upgrading OS , bringing that data node back in cluster. Problem: We want to ensure data con… --- ## [Avoid duplicates code in Logstash](https://discuss.elastic.co/t/avoid-duplicates-code-in-logstash/358695)
**Author:** [@Leo23](https://discuss.elastic.co/u/Leo23)\ **Replies:** 4\ **Last updated:** [May 4, 2024, 4:41pm UTC](https://discuss.elastic.co/t/avoid-duplicates-code-in-logstash/358695 "2024-05-04T16:41:14Z")
I have a problem I want to measure the execution time between each step of a log. So I use Elapsed Filter but I can have hundred step in a logs how can I delete duplicate code like this : elapsed { unique\_i… --- ## [AWS S3 Output - Failed to open TCP Connection to](https://discuss.elastic.co/t/aws-s3-output-failed-to-open-tcp-connection-to/358656)
**Author:** [@Alex\_Jamieson](https://discuss.elastic.co/u/Alex_Jamieson)\ **Replies:** 17\ **Last updated:** [May 4, 2024, 3:21am UTC](https://discuss.elastic.co/t/aws-s3-output-failed-to-open-tcp-connection-to/358656 "2024-05-04T03:21:45Z")
Having issues getting the pipeline running \[main\] Pipeline error {:pipeline\_id=\>"main", :exception=\>#\, Failing to understand wh… --- ## [Problem with threshold alert and index connector](https://discuss.elastic.co/t/problem-with-threshold-alert-and-index-connector/357564)
**Author:** [@bot\_aro](https://discuss.elastic.co/u/bot_aro)\ **Replies:** 6\ **Last updated:** [May 4, 2024, 1:27am UTC](https://discuss.elastic.co/t/problem-with-threshold-alert-and-index-connector/357564 "2024-05-04T01:27:54Z")
Good afternoon, I am facing a problem with kibana alerts. I am using threshold alert with index connector. I'm trying to write a json like this { "message": """{{{#context.alerts}}} host.name: {{{host.name}}} {{/conte… --- ## [Built-in Visualizations don't seem to work](https://discuss.elastic.co/t/built-in-visualizations-dont-seem-to-work/358720)
**Author:** [@artschooldropout](https://discuss.elastic.co/u/artschooldropout)\ **Replies:** 8\ **Last updated:** [May 3, 2024, 9:02pm UTC](https://discuss.elastic.co/t/built-in-visualizations-dont-seem-to-work/358720 "2024-05-03T21:02:09Z")
I'm using Filebeat CEF module to ingest firewall logs. I'm playing around with visualizations, and none of the built-in visualizations seem to show any data. For instance, the "Top 10 Devices by Bandwidth \[Filebeat CEF\]"… --- ## [Split brain problem with two master nodes](https://discuss.elastic.co/t/split-brain-problem-with-two-master-nodes/358710)
**Author:** [@Amit\_Shukla](https://discuss.elastic.co/u/Amit_Shukla)\ **Replies:** 6\ **Last updated:** [May 3, 2024, 8:35pm UTC](https://discuss.elastic.co/t/split-brain-problem-with-two-master-nodes/358710 "2024-05-03T20:35:21Z")
We have a requirement where we need to upgrade OS and for that Elasticsearch will be fresh installed on the nodes. I have a question related to master nodes removal. We have 3 master nodes as part of the cluster. What a… --- ## [Beat.db grows to 12G Bytes in windows](https://discuss.elastic.co/t/beat-db-grows-to-12g-bytes-in-windows/358070)
**Author:** [@rugang](https://discuss.elastic.co/u/rugang)\ **Replies:** 2\ **Last updated:** [May 3, 2024, 8:17pm UTC](https://discuss.elastic.co/t/beat-db-grows-to-12g-bytes-in-windows/358070 "2024-05-03T20:17:00Z")
I installed auditbeat in windows (with the windows package). part of the configuration file is as following # =========================== Modules configuration ============================ auditbeat.modules: - module: … --- ## [Can't export rules using the detections api](https://discuss.elastic.co/t/cant-export-rules-using-the-detections-api/358731)
**Author:** [@Valencia](https://discuss.elastic.co/u/Valencia)\ **Replies:** 0\ **Last updated:** [May 3, 2024, 8:01pm UTC](https://discuss.elastic.co/t/cant-export-rules-using-the-detections-api/358731 "2024-05-03T20:01:39Z")
Hello, I'm trying to export the detection rules for some testing using the api. I've created two rules and I can manually export them from the gui but trying to query "api/detection\_engine/rules/\_export" doesn't really … --- ## [PacketBeat sometimes do not match the http.request with http.response](https://discuss.elastic.co/t/packetbeat-sometimes-do-not-match-the-http-request-with-http-response/358674)
**Author:** [@ccastro](https://discuss.elastic.co/u/ccastro)\ **Replies:** 1\ **Last updated:** [May 3, 2024, 6:23pm UTC](https://discuss.elastic.co/t/packetbeat-sometimes-do-not-match-the-http-request-with-http-response/358674 "2024-05-03T18:23:44Z")
Using packetbeat-8.13.2-linux-x86\_64 found that sometimes http.request do not match with the real http.response.body. The response.body belongs to another request. Try change to period: -1s and use pcap instead af\_packe… --- ## [Update By Query fails with 400 - Bad Request - couldn't debug and no details available](https://discuss.elastic.co/t/update-by-query-fails-with-400-bad-request-couldnt-debug-and-no-details-available/358523)
**Author:** [@Janani\_Sampath\_Kumar](https://discuss.elastic.co/u/Janani_Sampath_Kumar)\ **Replies:** 5\ **Last updated:** [May 3, 2024, 6:13pm UTC](https://discuss.elastic.co/t/update-by-query-fails-with-400-bad-request-couldnt-debug-and-no-details-available/358523 "2024-05-03T18:13:19Z")
Mapping: "students": { "properties": { "\_class": { "type": "keyword", "index": false, "doc\_values": false }, "id": { … --- ## [Network Maps](https://discuss.elastic.co/t/network-maps/358515)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 2\ **Last updated:** [May 3, 2024, 3:09pm UTC](https://discuss.elastic.co/t/network-maps/358515 "2024-05-03T15:09:39Z")
Hello, I wonder if anyone has figured out how to create a network topology map in Elastic? I have tried Graphs but that doesn't seem viable. I am considering creating a custom visualization using vega but wanted to se… --- ## [Test Rest API through python](https://discuss.elastic.co/t/test-rest-api-through-python/357531)
**Author:** [@navya\_k](https://discuss.elastic.co/u/navya_k)\ **Replies:** 23\ **Last updated:** [May 3, 2024, 2:57pm UTC](https://discuss.elastic.co/t/test-rest-api-through-python/357531 "2024-05-03T14:57:47Z")
We have Elastic search cluster with thousands of applications. We would like to read logs through python script from elastic cluster. Use Cases : Get logs of last 1 hour or 1 day If it has error 500 or 404 We would l… --- ## [Logstash re-processes files, incorrectly updates sincedb](https://discuss.elastic.co/t/logstash-re-processes-files-incorrectly-updates-sincedb/358640)
**Author:** [@antay](https://discuss.elastic.co/u/antay)\ **Replies:** 7\ **Last updated:** [May 3, 2024, 2:32pm UTC](https://discuss.elastic.co/t/logstash-re-processes-files-incorrectly-updates-sincedb/358640 "2024-05-03T14:32:55Z")
I've been struggling with this intermittent issue for months, where sometimes a log file is read twice into elasticsearch, and sincedb shows incorrect filenames while this is happening. Apologies for a long post, trying… --- ## [Getting "Read-only file system" error with Elasticsearch deployment on Kubernetes](https://discuss.elastic.co/t/getting-read-only-file-system-error-with-elasticsearch-deployment-on-kubernetes/358719)
**Author:** [@ascii](https://discuss.elastic.co/u/ascii)\ **Replies:** 0\ **Last updated:** [May 3, 2024, 2:17pm UTC](https://discuss.elastic.co/t/getting-read-only-file-system-error-with-elasticsearch-deployment-on-kubernetes/358719 "2024-05-03T14:17:20Z")
Hi! I'm trying to deploy Elasticsearch 7.12.0 on Kubernetes and have configured it to run as a single-node cluster. But after deployment, I encountered the following error: Exception in thread "main" org.elasticsearch… --- ## [Question Symbol filtering and machine learning error; startOffset must be non-negative, and endOffset must be \>= startOffset; got startOffset=14,endOffset=13](https://discuss.elastic.co/t/question-symbol-filtering-and-machine-learning-error-startoffset-must-be-non-negative-and-endoffset-must-be-startoffset-got-startoffset-14-endoffset-13/358716)
**Author:** [@Chenko](https://discuss.elastic.co/u/Chenko)\ **Replies:** 0\ **Last updated:** [May 3, 2024, 2:06pm UTC](https://discuss.elastic.co/t/question-symbol-filtering-and-machine-learning-error-startoffset-must-be-non-negative-and-endoffset-must-be-startoffset-got-startoffset-14-endoffset-13/358716 "2024-05-03T14:06:29Z")
Hi! I have the following error: { "error": { "root\_cause": \[ { "type": "illegal\_argument\_exception", "reason": "startOffset must be non-negative, and endOffset must be \>= startOffset; got st… --- ## [Date\_histogram returning duplicates in multi-cluster after upgrade](https://discuss.elastic.co/t/date-histogram-returning-duplicates-in-multi-cluster-after-upgrade/358569)
**Author:** [@Doc\_Kaos](https://discuss.elastic.co/u/Doc_Kaos)\ **Replies:** 2\ **Last updated:** [May 3, 2024, 1:29pm UTC](https://discuss.elastic.co/t/date-histogram-returning-duplicates-in-multi-cluster-after-upgrade/358569 "2024-05-03T13:29:28Z")
Hey all, we recently upgraded clusters from 8.10.2 to 8.13.2. Our cross-cluster search cluster is still running 7.17. We noticed we are receiving duplicate keys in buckets after the remote clusters upgraded. If we reduce… --- ## [Available performance data from ESRally Perf Tool](https://discuss.elastic.co/t/available-performance-data-from-esrally-perf-tool/358660)
**Author:** [@tommyd](https://discuss.elastic.co/u/tommyd)\ **Replies:** 8\ **Last updated:** [May 3, 2024, 1:01pm UTC](https://discuss.elastic.co/t/available-performance-data-from-esrally-perf-tool/358660 "2024-05-03T13:01:53Z")
Hello ES gurus, I am just curious if there are any performance results available for any ESRally tracks. I searched on the internet but have not come up with anything. Here is the reason why I am looking for such data… --- ## [How to remove toggle dialogue with details from save search table used in dashboard](https://discuss.elastic.co/t/how-to-remove-toggle-dialogue-with-details-from-save-search-table-used-in-dashboard/358513)
**Author:** [@kishorkumar](https://discuss.elastic.co/u/kishorkumar)\ **Replies:** 1\ **Last updated:** [May 3, 2024, 12:22pm UTC](https://discuss.elastic.co/t/how-to-remove-toggle-dialogue-with-details-from-save-search-table-used-in-dashboard/358513 "2024-05-03T12:22:54Z")
How to remove toggle dialogue with details from save search table used in dashboard i want to removed that is marked in red when you click on that it will expand the document of that id like this that i don't want … --- ## [Using 7.8X version of kibana while ssl configuration getting error as below](https://discuss.elastic.co/t/using-7-8x-version-of-kibana-while-ssl-configuration-getting-error-as-below/358707)
**Author:** [@2328943\_dc](https://discuss.elastic.co/u/2328943_dc)\ **Replies:** 0\ **Last updated:** [May 3, 2024, 11:58am UTC](https://discuss.elastic.co/t/using-7-8x-version-of-kibana-while-ssl-configuration-getting-error-as-below/358707 "2024-05-03T11:58:34Z")
Using 7.8X version of kibana we are trying for ssl configuration using below link for guidence :\[Elasticsearch Cluster Security - TLS, SSL & CERTUTIL Certificates\] But while generating CA Certificate using below command… --- ## [What prevents rollover in a mapping?](https://discuss.elastic.co/t/what-prevents-rollover-in-a-mapping/358705)
**Author:** [@h.d.intodata](https://discuss.elastic.co/u/h.d.intodata)\ **Replies:** 0\ **Last updated:** [May 3, 2024, 11:40am UTC](https://discuss.elastic.co/t/what-prevents-rollover-in-a-mapping/358705 "2024-05-03T11:40:24Z")
Hi team, I have an elasticsearch index which I am wanting to apply an ILM on. I am able to reindex my original index and it preservers the mapping. However, when i try to apply the mapping to a rollover I get : "error"… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=247) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=249)