# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=256 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 257 --- ## [Attempted to resurrect connection to dead ES instance](https://discuss.elastic.co/t/attempted-to-resurrect-connection-to-dead-es-instance/358120)
**Author:** [@samsu](https://discuss.elastic.co/u/samsu)\ **Replies:** 5\ **Last updated:** [April 24, 2024, 2:19pm UTC](https://discuss.elastic.co/t/attempted-to-resurrect-connection-to-dead-es-instance/358120 "2024-04-24T14:19:24Z")
i have this error : \[2024-04-24T12:24:55,861\]\[INFO \]\[logstash.outputs.elasticsearch\]\[main\] Failed to perform request {:message=\>"Connect to localhost:9200 \[localhost/127.0.0.1\] failed: Connection refused (Connection ref… --- ## [Do I have too many shards?](https://discuss.elastic.co/t/do-i-have-too-many-shards/358027)
**Author:** [@Yoann\_Buzenet](https://discuss.elastic.co/u/Yoann_Buzenet)\ **Replies:** 1\ **Last updated:** [April 24, 2024, 2:15pm UTC](https://discuss.elastic.co/t/do-i-have-too-many-shards/358027 "2024-04-24T14:15:03Z")
My ELK stack passed in red status this morning because of missing memory on disk. After cleaning it a bit, it could reassign an unassigned shard and it came back to yellow again and it works. I checked the health endpoi… --- ## [Need to increase the return count from 10K for some benchmark testing](https://discuss.elastic.co/t/need-to-increase-the-return-count-from-10k-for-some-benchmark-testing/358127)
**Author:** [@BOYO](https://discuss.elastic.co/u/BOYO)\ **Replies:** 1\ **Last updated:** [April 24, 2024, 1:48pm UTC](https://discuss.elastic.co/t/need-to-increase-the-return-count-from-10k-for-some-benchmark-testing/358127 "2024-04-24T13:48:18Z")
As part of an internal POC we're trying to benchmark various queries from the JS client. We need to increase the return count for an individual query over 10k for one test. Tried scroll api since as per the docs it can … --- ## [Winlogbeat 1 thread full cpu usage](https://discuss.elastic.co/t/winlogbeat-1-thread-full-cpu-usage/358128)
**Author:** [@Speertje](https://discuss.elastic.co/u/Speertje)\ **Replies:** 0\ **Last updated:** [April 24, 2024, 1:17pm UTC](https://discuss.elastic.co/t/winlogbeat-1-thread-full-cpu-usage/358128 "2024-04-24T13:17:54Z")
Recently upgraded from 7.15.1 to 7.17.x and then to 8.latest. From then on, 1 cpu thread will be 100% consumed by winlogbeat. OS is windows2016 Looking at the metrics, it is processing between 7 and 100 events per 30 … --- ## [Open Source SOAR integration with ELK](https://discuss.elastic.co/t/open-source-soar-integration-with-elk/358108)
**Author:** [@amjadkhan\_291](https://discuss.elastic.co/u/amjadkhan_291)\ **Replies:** 4\ **Last updated:** [April 24, 2024, 12:39pm UTC](https://discuss.elastic.co/t/open-source-soar-integration-with-elk/358108 "2024-04-24T12:39:25Z")
Hello All, Can anyone please suggest open source SOAR that works well with ELK Stack? Thank You. --- ## [Query throws error just by one term other working great](https://discuss.elastic.co/t/query-throws-error-just-by-one-term-other-working-great/358115)
**Author:** [@libertey](https://discuss.elastic.co/u/libertey)\ **Replies:** 0\ **Last updated:** [April 24, 2024, 11:12am UTC](https://discuss.elastic.co/t/query-throws-error-just-by-one-term-other-working-great/358115 "2024-04-24T11:12:20Z")
Im having a Problem with one query which throws that error: {"error":{"root\_cause":\[{"type":"illegal\_argument\_exception","reason":"\[from\] parameter cannot be negative"}\],"type":"illegal\_argument\_exception","reason":"\[f… --- ## [Delete logs from past year](https://discuss.elastic.co/t/delete-logs-from-past-year/358101)
**Author:** [@frh](https://discuss.elastic.co/u/frh)\ **Replies:** 0\ **Last updated:** [April 24, 2024, 8:59am UTC](https://discuss.elastic.co/t/delete-logs-from-past-year/358101 "2024-04-24T08:59:36Z")
Hi, I'm in attempt of deleting logs from past year 2022 in shrink-logstash-2021.11.28-000010. This index also contains logs from current year 2023-2024. I have millions of logs from past year 2022 and it's taking up to… --- ## [Java API Client - Geo Bounding Box Query from Geohash](https://discuss.elastic.co/t/java-api-client-geo-bounding-box-query-from-geohash/358082)
**Author:** [@tschmidt01](https://discuss.elastic.co/u/tschmidt01)\ **Replies:** 2\ **Last updated:** [April 24, 2024, 8:18am UTC](https://discuss.elastic.co/t/java-api-client-geo-bounding-box-query-from-geohash/358082 "2024-04-24T08:18:35Z")
Using the old java client you could create a geo bounding box query by just supplying a geohash like so: QueryBuilders.geoBoundingBoxQuery("some-field") .setCorners("some-geo-hash") Was this feature rem… --- ## [Location of logs](https://discuss.elastic.co/t/location-of-logs/358088)
**Author:** [@m\_pahlevanzadeh](https://discuss.elastic.co/u/m_pahlevanzadeh)\ **Replies:** 1\ **Last updated:** [April 24, 2024, 7:30am UTC](https://discuss.elastic.co/t/location-of-logs/358088 "2024-04-24T07:30:55Z")
I installed ELK and it strores log and yesterday my / was 9.3G and today / is 33G. So I decided to change path of logs to new disk. But i don't know which directory should be mounted. --- ## [Filebeat is not pushing nginx logs to logstash in correct format](https://discuss.elastic.co/t/filebeat-is-not-pushing-nginx-logs-to-logstash-in-correct-format/356659)
**Author:** [@sudhir\_singh](https://discuss.elastic.co/u/sudhir_singh)\ **Replies:** 4\ **Last updated:** [April 24, 2024, 7:28am UTC](https://discuss.elastic.co/t/filebeat-is-not-pushing-nginx-logs-to-logstash-in-correct-format/356659 "2024-04-24T07:28:08Z")
66.249.68.6, 23.59.21.50, 23.66.234.17, 104.97.76.62, 172.24.23.111, 172.24.58.27 "03/Apr/2024:03:50:44 +0530" "66.249.68.6" GET "GET /astrology/others/dream-interpretation-beginning-with-alphabet-p/articleshow/68205693.… --- ## [TLS configuration](https://discuss.elastic.co/t/tls-configuration/357802)
**Author:** [@boosterino](https://discuss.elastic.co/u/boosterino)\ **Replies:** 6\ **Last updated:** [April 24, 2024, 7:27am UTC](https://discuss.elastic.co/t/tls-configuration/357802 "2024-04-24T07:27:55Z")
Hi I ran out of ideas. I have kibana (my wildcard cert, \*.hostname.net). Kibana is ok. kibana.yml server.publicBaseUrl: "https://kibanaprod.hostname.net" elasticsearch.hosts: \["https://elkprod1.hostname.net:9200", "… --- ## [Error message](https://discuss.elastic.co/t/error-message/358032)
**Author:** [@samsu](https://discuss.elastic.co/u/samsu)\ **Replies:** 9\ **Last updated:** [April 24, 2024, 7:27am UTC](https://discuss.elastic.co/t/error-message/358032 "2024-04-24T07:27:32Z")
I am encountering an issue with establishing a connection from Logstash to my local Elasticsearch instance. Each time I attempt to send data from Logstash to Elasticsearch, I receive the following error messages: \[logst… --- ## [How to monitor the services on linux machine using the elastic agent](https://discuss.elastic.co/t/how-to-monitor-the-services-on-linux-machine-using-the-elastic-agent/358023)
**Author:** [@Subrahmanyam\_Veerank](https://discuss.elastic.co/u/Subrahmanyam_Veerank)\ **Replies:** 2\ **Last updated:** [April 24, 2024, 7:13am UTC](https://discuss.elastic.co/t/how-to-monitor-the-services-on-linux-machine-using-the-elastic-agent/358023 "2024-04-24T07:13:05Z")
Sir, i have installed elastic agent in a linux machine and i want to monitor the services. How to achieve that? --- ## [Can Rollover API / ILM be used to keep only last x days of data in the current index](https://discuss.elastic.co/t/can-rollover-api-ilm-be-used-to-keep-only-last-x-days-of-data-in-the-current-index/358093)
**Author:** [@touseef\_rafique](https://discuss.elastic.co/u/touseef_rafique)\ **Replies:** 0\ **Last updated:** [April 24, 2024, 6:43am UTC](https://discuss.elastic.co/t/can-rollover-api-ilm-be-used-to-keep-only-last-x-days-of-data-in-the-current-index/358093 "2024-04-24T06:43:38Z")
I went thru some threads regarding this question and most of them suggest using DeleteByQuery as Rollover API seems to delete/move to other phase the indices and create the new ones based on given condition. but DeleteB… --- ## [Is my logstash working?](https://discuss.elastic.co/t/is-my-logstash-working/358087)
**Author:** [@marlonws](https://discuss.elastic.co/u/marlonws)\ **Replies:** 0\ **Last updated:** [April 24, 2024, 6:26am UTC](https://discuss.elastic.co/t/is-my-logstash-working/358087 "2024-04-24T06:26:33Z")
The input 8080 if I forward its service it responds with an OK on the web page The input 5044 doesn't return anything to me, now I don't know if it's really working or there really isn't a response page for the 5044. --- ## [How to provide input from keyboard to script. Input can be service name or application](https://discuss.elastic.co/t/how-to-provide-input-from-keyboard-to-script-input-can-be-service-name-or-application/358046)
**Author:** [@navya\_k](https://discuss.elastic.co/u/navya_k)\ **Replies:** 3\ **Last updated:** [April 24, 2024, 5:47am UTC](https://discuss.elastic.co/t/how-to-provide-input-from-keyboard-to-script-input-can-be-service-name-or-application/358046 "2024-04-24T05:47:38Z")
Hello, I have written below code to accept input from keyboard and retrieve data from elasticsearch cluster from elasticsearch import Elasticsearch from datetime import datetime es = Elasticsearch ("https://localhost… --- ## [Version of org.elasticsearch.common.inject library used in Elasticsearch 7.10.2](https://discuss.elastic.co/t/version-of-org-elasticsearch-common-inject-library-used-in-elasticsearch-7-10-2/357993)
**Author:** [@Prashant\_Singh](https://discuss.elastic.co/u/Prashant_Singh)\ **Replies:** 5\ **Last updated:** [April 24, 2024, 5:36am UTC](https://discuss.elastic.co/t/version-of-org-elasticsearch-common-inject-library-used-in-elasticsearch-7-10-2/357993 "2024-04-24T05:36:22Z")
How to know which version of org.elasticsearch.common.inject library used in Elasticsearch 7.10.2 ? --- ## [Project does not support PATCH request](https://discuss.elastic.co/t/project-does-not-support-patch-request/358075)
**Author:** [@minhdai998](https://discuss.elastic.co/u/minhdai998)\ **Replies:** 1\ **Last updated:** [April 24, 2024, 5:25am UTC](https://discuss.elastic.co/t/project-does-not-support-patch-request/358075 "2024-04-24T05:25:28Z")
I need to update certain fields for documents in Elastic Search Cloud, but my project does not support PATCH request. I found a solution where I can override POST request by adding the following parameter in header "X-HT… --- ## [Overcoming search.max\_buckets Limitation in AWS Elasticsearch for Shard-Level Aggregations](https://discuss.elastic.co/t/overcoming-search-max-buckets-limitation-in-aws-elasticsearch-for-shard-level-aggregations/358079)
**Author:** [@Yuki\_Hara](https://discuss.elastic.co/u/Yuki_Hara)\ **Replies:** 3\ **Last updated:** [April 24, 2024, 5:23am UTC](https://discuss.elastic.co/t/overcoming-search-max-buckets-limitation-in-aws-elasticsearch-for-shard-level-aggregations/358079 "2024-04-24T05:23:50Z")
Objective: Perform aggregation (terms aggregation) on all documents within each shard. Actions Taken & Issues: Set size: 100 (assuming size should remain unchanged) Set shard\_size to 2147483519 Set shard\_size to 1000… --- ## [Logstash stopped processing because of an error](https://discuss.elastic.co/t/logstash-stopped-processing-because-of-an-error/357956)
**Author:** [@cariinaar](https://discuss.elastic.co/u/cariinaar)\ **Replies:** 3\ **Last updated:** [April 24, 2024, 3:27am UTC](https://discuss.elastic.co/t/logstash-stopped-processing-because-of-an-error/357956 "2024-04-24T03:27:06Z")
I have followed solutions to similar topics, but none of the solutions seem to be working for my case. I have tried numerous solutions but the results when i tail logstash-plain.log is always the same which is like below… --- ## [The Metricbeat 7.17.14 monitoring interface can be used to query the closed es indices, leading to a lack of data in the Overview and Indices sections of the Elasticsearch dashboard within Metricbeat. This issue does not exist in es8.x, it's bug](https://discuss.elastic.co/t/the-metricbeat-7-17-14-monitoring-interface-can-be-used-to-query-the-closed-es-indices-leading-to-a-lack-of-data-in-the-overview-and-indices-sections-of-the-elasticsearch-dashboard-within-metricbeat-this-issue-does-not-exist-in-es8-x-its-bug/358068)
**Author:** [@changshunmin](https://discuss.elastic.co/u/changshunmin)\ **Replies:** 2\ **Last updated:** [April 24, 2024, 2:44am UTC](https://discuss.elastic.co/t/the-metricbeat-7-17-14-monitoring-interface-can-be-used-to-query-the-closed-es-indices-leading-to-a-lack-of-data-in-the-overview-and-indices-sections-of-the-elasticsearch-dashboard-within-metricbeat-this-issue-does-not-exist-in-es8-x-its-bug/358068 "2024-04-24T02:44:24Z")
Using metricbeat 7.17.14-linux-x86\_64 to monitor Elasticsearch of Elk cluster, when closing the ES historical index, the Overview and Indicators index list of the ES cluster in the metricbeat monitoring dashboard cannot … --- ## [Elasticsearch Kibana](https://discuss.elastic.co/t/elasticsearch-kibana/357049)
**Author:** [@Nicnathaniel](https://discuss.elastic.co/u/Nicnathaniel)\ **Replies:** 13\ **Last updated:** [April 24, 2024, 2:06am UTC](https://discuss.elastic.co/t/elasticsearch-kibana/357049 "2024-04-24T02:06:01Z")
Hi I recently started testing Elasticsearch Kibana's anomaly detection and so far it is working fine where anomalies are detected. However I am wondering if I am able to click something that brings me to the log that was… --- ## [Is this logic right?](https://discuss.elastic.co/t/is-this-logic-right/358063)
**Author:** [@Marlon\_Westphol](https://discuss.elastic.co/u/Marlon_Westphol)\ **Replies:** 1\ **Last updated:** [April 24, 2024, 12:56am UTC](https://discuss.elastic.co/t/is-this-logic-right/358063 "2024-04-24T00:56:17Z")
In short: I have an elastic agent on a remote host A Logstash with elasticsearch on the same kubernetes host on a remote host B Will the logstash input plugin for elastic agent or beats always be 5044? Will I have to d… --- ## [Trying to install the IMAP input plugin to logstash on windows](https://discuss.elastic.co/t/trying-to-install-the-imap-input-plugin-to-logstash-on-windows/358060)
**Author:** [@Mike\_Yates](https://discuss.elastic.co/u/Mike_Yates)\ **Replies:** 0\ **Last updated:** [April 23, 2024, 9:18pm UTC](https://discuss.elastic.co/t/trying-to-install-the-imap-input-plugin-to-logstash-on-windows/358060 "2024-04-23T21:18:14Z")
I have not had any success and the documentation seems somewhat lacking. Does anyone have an idiots guide on how to download, install and run the IMAP plugin. I'm new to playing with additional plugins .. Thanks in adv… --- ## [Enrich source index compression](https://discuss.elastic.co/t/enrich-source-index-compression/358058)
**Author:** [@cvarano](https://discuss.elastic.co/u/cvarano)\ **Replies:** 0\ **Last updated:** [April 23, 2024, 8:29pm UTC](https://discuss.elastic.co/t/enrich-source-index-compression/358058 "2024-04-23T20:29:59Z")
I have a very large source index for an enrich policy that stores two sparse\_vector fields, which is almost 500gb on disk (no replicas). Here's the source index mappings: { "mappings": { "dynamic\_templates": \[\], … --- ## [Cómo saber, en base a la cantidad de consultas que recibe una tienda en línea, los requisitos para instalar elastic](https://discuss.elastic.co/t/como-saber-en-base-a-la-cantidad-de-consultas-que-recibe-una-tienda-en-linea-los-requisitos-para-instalar-elastic/358054)
**Author:** [@omarod](https://discuss.elastic.co/u/omarod)\ **Replies:** 0\ **Last updated:** [April 23, 2024, 7:20pm UTC](https://discuss.elastic.co/t/como-saber-en-base-a-la-cantidad-de-consultas-que-recibe-una-tienda-en-linea-los-requisitos-para-instalar-elastic/358054 "2024-04-23T19:20:09Z")
Quiero usar Elastic pero no se cuánto de memoria y disco asignarle. El dato que tengo, es que tengo 120 mil búsquedas en promedio al mes en mi sitio web --- ## [Annotations section](https://discuss.elastic.co/t/annotations-section/358041)
**Author:** [@zi\_ninja](https://discuss.elastic.co/u/zi_ninja)\ **Replies:** 2\ **Last updated:** [April 23, 2024, 4:29pm UTC](https://discuss.elastic.co/t/annotations-section/358041 "2024-04-23T16:29:33Z")
In the single metric viewer, I see a lot of annotations, marked 1,2,3,... (1 as the red arrow points to). What this means. I see that the birth of 1,2,3,... does not follow a rule, am I misunderstanding the problem here? … --- ## [Dynamically bring nested fields to root level](https://discuss.elastic.co/t/dynamically-bring-nested-fields-to-root-level/357948)
**Author:** [@rubhamra](https://discuss.elastic.co/u/rubhamra)\ **Replies:** 5\ **Last updated:** [April 23, 2024, 2:53pm UTC](https://discuss.elastic.co/t/dynamically-bring-nested-fields-to-root-level/357948 "2024-04-23T14:53:14Z")
I need to extract fields, full\_name, roles, email and username from below output "Mika.singh" =\> { "metadata" =\> {}, "full\_name" =\> "mika singh", "roles" =\> \[ \[0\] "teaml", … --- ## [Does using phonetic analyzer using .json file kills the effect of Fuzzy Search](https://discuss.elastic.co/t/does-using-phonetic-analyzer-using-json-file-kills-the-effect-of-fuzzy-search/357916)
**Author:** [@satadru\_biswas](https://discuss.elastic.co/u/satadru_biswas)\ **Replies:** 10\ **Last updated:** [April 23, 2024, 2:44pm UTC](https://discuss.elastic.co/t/does-using-phonetic-analyzer-using-json-file-kills-the-effect-of-fuzzy-search/357916 "2024-04-23T14:44:51Z")
So created an entity class. @Data @Document(indexName = "ABC") @Setting(settingPath = "analyzer/search-analyzer.json") @JsonIgnoreProperties(ignoreUnknown = true) @Slf4j @EqualsAndHashCode public class XYZ { @Field(ty… --- ## [Parsing a syslog message before sending to elastic with empty fields](https://discuss.elastic.co/t/parsing-a-syslog-message-before-sending-to-elastic-with-empty-fields/357795)
**Author:** [@devdem13](https://discuss.elastic.co/u/devdem13)\ **Replies:** 7\ **Last updated:** [April 23, 2024, 2:45pm UTC](https://discuss.elastic.co/t/parsing-a-syslog-message-before-sending-to-elastic-with-empty-fields/357795 "2024-04-23T14:45:54Z")
Hi, I am sending syslog data to logstash in the form of attribute=value separated by spaces. Sometime some fields might be empty. For example in the syslog message you might have: JOBNAME=ABCD SOURCE= CLASS=CLASS1 E… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=255) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=257)