# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=274 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 275 --- ## [Reindex large index](https://discuss.elastic.co/t/reindex-large-index/356450)
**Author:** [@abkrim](https://discuss.elastic.co/u/abkrim)\ **Replies:** 0\ **Last updated:** [March 29, 2024, 9:26am UTC](https://discuss.elastic.co/t/reindex-large-index/356450 "2024-03-29T09:26:53Z")
Today I was faced with a reindex due to a question of deleting a field, plus a change in the mapping of the datetime field that I had planned. I have done it with PHP. 42 million docs passed, even though the process la… --- ## [Elasticsearch on EKS Fargate](https://discuss.elastic.co/t/elasticsearch-on-eks-fargate/356448)
**Author:** [@muhammadali1233ify](https://discuss.elastic.co/u/muhammadali1233ify)\ **Replies:** 0\ **Last updated:** [March 29, 2024, 9:11am UTC](https://discuss.elastic.co/t/elasticsearch-on-eks-fargate/356448 "2024-03-29T09:11:36Z")
Hi Community. I have been trying to host / run elasticsearch on fargate but running into permission issues. the default init container definition looks osmething like this. initContainers: - name: init-sysctl … --- ## [Gathering information on daily usages](https://discuss.elastic.co/t/gathering-information-on-daily-usages/356439)
**Author:** [@Muhd\_Murad](https://discuss.elastic.co/u/Muhd_Murad)\ **Replies:** 0\ **Last updated:** [March 29, 2024, 6:20am UTC](https://discuss.elastic.co/t/gathering-information-on-daily-usages/356439 "2024-03-29T06:20:16Z")
Hello Experts, I would like to gather information about our daily/monthly usages in Elastic. I did go thru the stack monitoring but not much information i get in there. I am looking to have daily ingestion in GB, disk … --- ## [Wildcard pattern not working for trusted applications](https://discuss.elastic.co/t/wildcard-pattern-not-working-for-trusted-applications/356437)
**Author:** [@Krishna\_Teja](https://discuss.elastic.co/u/Krishna_Teja)\ **Replies:** 0\ **Last updated:** [March 29, 2024, 4:09am UTC](https://discuss.elastic.co/t/wildcard-pattern-not-working-for-trusted-applications/356437 "2024-03-29T04:09:25Z")
Hi I was trying to add a trusted application to a policy. Adding full path works but the moment I change it to a wildcard pattern, it stops working Eg: C:\\Users\\IEUser\\Desktop\\app.exe works fine but C:\\Users\\\*\\Desktop\\… --- ## [Hardware requirements for high performant search on a 200M vector dataset](https://discuss.elastic.co/t/hardware-requirements-for-high-performant-search-on-a-200m-vector-dataset/356340)
**Author:** [@nadasaiyed](https://discuss.elastic.co/u/nadasaiyed)\ **Replies:** 1\ **Last updated:** [March 29, 2024, 1:09am UTC](https://discuss.elastic.co/t/hardware-requirements-for-high-performant-search-on-a-200m-vector-dataset/356340 "2024-03-29T01:09:54Z")
I am trying to understand how much hardware will I need to store 50M vectors of dimension 1536, projected to reach 200M. I have read HNSW index is stored in memory, will I need as much RAM as the data to do a similarity … --- ## [Node client: Sniffing does not wait for return routing requests potentially via discovery nodes](https://discuss.elastic.co/t/node-client-sniffing-does-not-wait-for-return-routing-requests-potentially-via-discovery-nodes/356119)
**Author:** [@spinscale](https://discuss.elastic.co/u/spinscale)\ **Replies:** 2\ **Last updated:** [March 29, 2024, 12:29am UTC](https://discuss.elastic.co/t/node-client-sniffing-does-not-wait-for-return-routing-requests-potentially-via-discovery-nodes/356119 "2024-03-29T00:29:17Z")
Hey, I've been using the typescript client and wondered about the sniffing behaviour using the following code: const client = new Client({ nodes: \[ "http://localhost:9200" \], sniffOnStart: true, … --- ## ["File corruption occurred on recovery but checksums are ok"](https://discuss.elastic.co/t/file-corruption-occurred-on-recovery-but-checksums-are-ok/356341)
**Author:** [@CWS-Dan](https://discuss.elastic.co/u/CWS-Dan)\ **Replies:** 6\ **Last updated:** [March 28, 2024, 11:26pm UTC](https://discuss.elastic.co/t/file-corruption-occurred-on-recovery-but-checksums-are-ok/356341 "2024-03-28T23:26:51Z")
I'm running Elasticsearch 7.14.0. I have a cluster with 3 nodes: CWS-CWHELP, CWS-CWHELP2, and CWS-CWHELP3. 1 and 3 are fine, but 2 is having problems I cannot explain. When it runs, and the cluster tries to allocate shar… --- ## [How to divide sarchs to get percentage metric](https://discuss.elastic.co/t/how-to-divide-sarchs-to-get-percentage-metric/356430)
**Author:** [@MR98](https://discuss.elastic.co/u/MR98)\ **Replies:** 0\ **Last updated:** [March 28, 2024, 10:40pm UTC](https://discuss.elastic.co/t/how-to-divide-sarchs-to-get-percentage-metric/356430 "2024-03-28T22:40:12Z")
I created two searchs: Search 1 - TEXT.X\* and Search 2 - TEXT.Y\* How should I combine agregations in metric or create new search to get something like math operation (TEXT.X\* / TEXT.Y\*)\*100: I saved new search: TEX… --- ## [Combine a few rules into 1 rule](https://discuss.elastic.co/t/combine-a-few-rules-into-1-rule/356375)
**Author:** [@yuswanul](https://discuss.elastic.co/u/yuswanul)\ **Replies:** 5\ **Last updated:** [March 28, 2024, 10:29pm UTC](https://discuss.elastic.co/t/combine-a-few-rules-into-1-rule/356375 "2024-03-28T22:29:47Z")
Hello guys, I have a case about alerting here. so, the condition to trigger this alert is so simple. there are 3 codes that I watched using this alert which are 68, 40, X5 if code 68 appeared 10 times in 1 minute, the… --- ## [Logstash elastic\_integration plugin for on-prem basic license?](https://discuss.elastic.co/t/logstash-elastic-integration-plugin-for-on-prem-basic-license/356424)
**Author:** [@tdanno](https://discuss.elastic.co/u/tdanno)\ **Replies:** 1\ **Last updated:** [March 28, 2024, 9:34pm UTC](https://discuss.elastic.co/t/logstash-elastic-integration-plugin-for-on-prem-basic-license/356424 "2024-03-28T21:34:14Z")
I see in the plugin documentation that you need an enterprise license... is that because of the cloud functionality aspect of it? Is it possible to use this with a basic license anyway if outputting to an on-premise ES … --- ## [Logstash JMS plugin extremly slow](https://discuss.elastic.co/t/logstash-jms-plugin-extremly-slow/356210)
**Author:** [@Oussama\_seif\_eddine](https://discuss.elastic.co/u/Oussama_seif_eddine)\ **Replies:** 7\ **Last updated:** [March 28, 2024, 9:23pm UTC](https://discuss.elastic.co/t/logstash-jms-plugin-extremly-slow/356210 "2024-03-28T21:23:14Z")
Hello, I'm using Logstash JMS plugin to connect to an EMS server and fetch data from a queue. I output then to my elastic cluster (2 nodes). The issue is that even i have a lot of consumers (300 thread/logstach server… --- ## [Filebeat on Docker Swarm](https://discuss.elastic.co/t/filebeat-on-docker-swarm/356330)
**Author:** [@bobus](https://discuss.elastic.co/u/bobus)\ **Replies:** 1\ **Last updated:** [March 28, 2024, 9:20pm UTC](https://discuss.elastic.co/t/filebeat-on-docker-swarm/356330 "2024-03-28T21:20:35Z")
Running version 8.12 on Docker Swarm, I want to export all logs from this swarm to a Logstash-type input that runs on Graylog. After a day of work I got data into Graylog but with very, very few fields. I'm guessing that… --- ## [Is it possible to use multiple pipeline.yml files?](https://discuss.elastic.co/t/is-it-possible-to-use-multiple-pipeline-yml-files/356006)
**Author:** [@Aroque\_R](https://discuss.elastic.co/u/Aroque_R)\ **Replies:** 2\ **Last updated:** [March 28, 2024, 8:24pm UTC](https://discuss.elastic.co/t/is-it-possible-to-use-multiple-pipeline-yml-files/356006 "2024-03-28T20:24:22Z")
I was thinking if i can set multiple pipeline.yml for multiple instances in the same machine like one in /etc/logstash/team\_x other in /etc/logstash/team\_y --- ## [Metricbeat Windows module claims "failed to query" but still has data](https://discuss.elastic.co/t/metricbeat-windows-module-claims-failed-to-query-but-still-has-data/356418)
**Author:** [@amorrow](https://discuss.elastic.co/u/amorrow)\ **Replies:** 0\ **Last updated:** [March 28, 2024, 7:20pm UTC](https://discuss.elastic.co/t/metricbeat-windows-module-claims-failed-to-query-but-still-has-data/356418 "2024-03-28T19:20:19Z")
Hi. I use Metricbeat to collect data from some Windows servers using perfmon. I'm in the process of upgrading Metricbeat from 7.16.0 to 8.13.0 and ran into a weird issue where the output has an "error.message" field sayi… --- ## [How to combine multiple conditional query in one query](https://discuss.elastic.co/t/how-to-combine-multiple-conditional-query-in-one-query/354033)
**Author:** [@amrswalha](https://discuss.elastic.co/u/amrswalha)\ **Replies:** 7\ **Last updated:** [March 28, 2024, 7:12pm UTC](https://discuss.elastic.co/t/how-to-combine-multiple-conditional-query-in-one-query/354033 "2024-03-28T19:12:38Z")
Hello, I'm new to using Elasticsearch. I'm using the .NET client version 8.12, I'm trying to send a query based on parameters. Only add the condition if the parameter value exists. Below is the code for the query: publi… --- ## [Elasticsearch queue issue after upgrading from 8.6.2 to 8.12.1/8.12.2](https://discuss.elastic.co/t/elasticsearch-queue-issue-after-upgrading-from-8-6-2-to-8-12-1-8-12-2/355052)
**Author:** [@elastic\_dude](https://discuss.elastic.co/u/elastic_dude)\ **Replies:** 35\ **Last updated:** [March 28, 2024, 6:51pm UTC](https://discuss.elastic.co/t/elasticsearch-queue-issue-after-upgrading-from-8-6-2-to-8-12-1-8-12-2/355052 "2024-03-28T18:51:03Z")
We have been running on Elasticsearch 8.6.2 for several months now with very few issues other than some query (un)optimizations. We have several clusters duplicated in two regions + two non-prod environments with several… --- ## [Fields in Kibana from Filebeat](https://discuss.elastic.co/t/fields-in-kibana-from-filebeat/356392)
**Author:** [@Yerbolat\_Talasbekov](https://discuss.elastic.co/u/Yerbolat_Talasbekov)\ **Replies:** 1\ **Last updated:** [March 28, 2024, 6:39pm UTC](https://discuss.elastic.co/t/fields-in-kibana-from-filebeat/356392 "2024-03-28T18:39:55Z")
Hello EveryOne, help me please!! Can't understand why I am getting 7306 fields from Filebeat logs. Here is from Kibana Fields (7306) Scripted fields (0) Field filters (0) Relationships (0) --- ## [Export data to pdf](https://discuss.elastic.co/t/export-data-to-pdf/356191)
**Author:** [@Fatiha](https://discuss.elastic.co/u/Fatiha)\ **Replies:** 5\ **Last updated:** [March 28, 2024, 4:52pm UTC](https://discuss.elastic.co/t/export-data-to-pdf/356191 "2024-03-28T16:52:00Z")
HI I want to export my charts that I visualize in kibana to pdf I can't find this option in my dashboard hwo can I export my charts to pdf ?? --- ## [Unsupported Media Type - issues when trying to do a comparison of spaces components and copying over into existing space all types in one ansible script](https://discuss.elastic.co/t/unsupported-media-type-issues-when-trying-to-do-a-comparison-of-spaces-components-and-copying-over-into-existing-space-all-types-in-one-ansible-script/356409)
**Author:** [@lcarr](https://discuss.elastic.co/u/lcarr)\ **Replies:** 0\ **Last updated:** [March 28, 2024, 4:39pm UTC](https://discuss.elastic.co/t/unsupported-media-type-issues-when-trying-to-do-a-comparison-of-spaces-components-and-copying-over-into-existing-space-all-types-in-one-ansible-script/356409 "2024-03-28T16:39:39Z")
We are migrating from one space in our kibana to another - there are over 500 elements in the one space, visualizations, queries, lens, dashboards etc. We have been able to get a file created but when we run the ansible… --- ## [PutLifecycleRequest with new Java client](https://discuss.elastic.co/t/putlifecyclerequest-with-new-java-client/356402)
**Author:** [@avnere](https://discuss.elastic.co/u/avnere)\ **Replies:** 3\ **Last updated:** [March 28, 2024, 3:27pm UTC](https://discuss.elastic.co/t/putlifecyclerequest-with-new-java-client/356402 "2024-03-28T15:27:44Z")
Hi, What is the approach for creating Lifecycle Policy with new Java client. Policy of rollover after 10gb maxShardSize and delete after 5d. Thanks... --- ## [Comparing two data sources in a data table or visualization?](https://discuss.elastic.co/t/comparing-two-data-sources-in-a-data-table-or-visualization/356407)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 0\ **Last updated:** [March 28, 2024, 3:24pm UTC](https://discuss.elastic.co/t/comparing-two-data-sources-in-a-data-table-or-visualization/356407 "2024-03-28T15:24:44Z")
Hello, I was wondering about how I can compare two different data sources but have the same field. For example, I want to do analysis by comparing users that are present in one data source and user that are disabled fro… --- ## [Query with track\_total\_hits:true faster than track\_total\_hits:false](https://discuss.elastic.co/t/query-with-track-total-hits-true-faster-than-track-total-hits-false/356291)
**Author:** [@spinscale](https://discuss.elastic.co/u/spinscale)\ **Replies:** 6\ **Last updated:** [March 28, 2024, 3:09pm UTC](https://discuss.elastic.co/t/query-with-track-total-hits-true-faster-than-track-total-hits-false/356291 "2024-03-28T15:09:25Z")
Hey, I have a query that is actually twice as fast when tracking total hits (setting track\_total\_hits: true or adding an aggregation), than as running it with track\_total\_hits:false - which is contradictory to the idea … --- ## [Kibana Visualize for nested field](https://discuss.elastic.co/t/kibana-visualize-for-nested-field/356299)
**Author:** [@bertugmete](https://discuss.elastic.co/u/bertugmete)\ **Replies:** 1\ **Last updated:** [March 28, 2024, 2:47pm UTC](https://discuss.elastic.co/t/kibana-visualize-for-nested-field/356299 "2024-03-28T14:47:54Z")
I'm trying to create a visualization in Kibana where I display the data from my Elasticsearch index in a data table format. However, when I select the "Terms" aggregation, the "violation\_list" field does not appear. My g… --- ## [Configuring PDB in Oracle Integration](https://discuss.elastic.co/t/configuring-pdb-in-oracle-integration/356394)
**Author:** [@gurbelunder](https://discuss.elastic.co/u/gurbelunder)\ **Replies:** 1\ **Last updated:** [March 28, 2024, 12:19pm UTC](https://discuss.elastic.co/t/configuring-pdb-in-oracle-integration/356394 "2024-03-28T12:19:46Z")
Hi everybody, actually I'm trying to configure an Oracle Multitenant Database with one CDB and one PDB in Oracle Integration in Elastic in Cloud on Version 8.12. Oracle Integration is version 1.24.3. First of all my CD… --- ## [Debug indexing time](https://discuss.elastic.co/t/debug-indexing-time/356334)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 2\ **Last updated:** [March 28, 2024, 11:08am UTC](https://discuss.elastic.co/t/debug-indexing-time/356334 "2024-03-28T11:08:26Z")
Hi I need to know how I can debug the case when elastic is not responding during indexing time. But index.indexing.slowlog.threshold.index. it's not enough I don't see any overload on cluster where elastic was install… --- ## [Installed elasticsearch forgot systemd!](https://discuss.elastic.co/t/installed-elasticsearch-forgot-systemd/356384)
**Author:** [@stobbe](https://discuss.elastic.co/u/stobbe)\ **Replies:** 1\ **Last updated:** [March 28, 2024, 10:46am UTC](https://discuss.elastic.co/t/installed-elasticsearch-forgot-systemd/356384 "2024-03-28T10:46:12Z")
Hello, After installing elasticsearch, I would like to be able to add systemd e.g. Wat are the steps to make elasticsearch use systemctl commands for starting and stopping? KR Henk --- ## [org.elasticsearch.common.util.concurrent.TimedRunnable@62542b52 on queueresizingESThreadPoolExecutor](https://discuss.elastic.co/t/org-elasticsearch-common-util-concurrent-timedrunnable-62542b52-on-queueresizingesthreadpoolexecutor/356387)
**Author:** [@LAKSHAY\_ARORA1](https://discuss.elastic.co/u/LAKSHAY_ARORA1)\ **Replies:** 0\ **Last updated:** [March 28, 2024, 10:42am UTC](https://discuss.elastic.co/t/org-elasticsearch-common-util-concurrent-timedrunnable-62542b52-on-queueresizingesthreadpoolexecutor/356387 "2024-03-28T10:42:23Z")
I am getting an error on my elasticsearch production cluster. I understand it is related to a thread pool which is getting out of memory or is not able to process huge amount of requests at a time. Can anyone explai… --- ## [Error: elastic agent error failed to publish events: temporary bulk send failure](https://discuss.elastic.co/t/error-elastic-agent-error-failed-to-publish-events-temporary-bulk-send-failure/356368)
**Author:** [@hasan.idriss](https://discuss.elastic.co/u/hasan.idriss)\ **Replies:** 4\ **Last updated:** [March 28, 2024, 10:05am UTC](https://discuss.elastic.co/t/error-elastic-agent-error-failed-to-publish-events-temporary-bulk-send-failure/356368 "2024-03-28T10:05:48Z")
hello I have a cluster of 3 ES nodes version 8.7.1 I am managing the agents using the fleet I had installed Elasticagent on a Windows VM to ingest the fortigate logs and it was successfully until one day logs ingesti… --- ## [Problem in match query](https://discuss.elastic.co/t/problem-in-match-query/356371)
**Author:** [@Paul\_Deveaux](https://discuss.elastic.co/u/Paul_Deveaux)\ **Replies:** 1\ **Last updated:** [March 28, 2024, 9:50am UTC](https://discuss.elastic.co/t/problem-in-match-query/356371 "2024-03-28T09:50:42Z")
Hello, I am a beginner in Elasticsearch. I'm encountering an issue with searching with specific words within a text field in my Elasticsearch index. Currently, I'm attempting to search for certain words within the fiel… --- ## [Certificate has expired](https://discuss.elastic.co/t/certificate-has-expired/356370)
**Author:** [@cyberzlo](https://discuss.elastic.co/u/cyberzlo)\ **Replies:** 0\ **Last updated:** [March 28, 2024, 8:56am UTC](https://discuss.elastic.co/t/certificate-has-expired/356370 "2024-03-28T08:56:17Z")
Hi, I hit error from logstash that was unable to connect to ES: Unable to retrieve version information from Elasticsearch nodes. certificate has expired My clusters are installed from Debian packages. Please give me mo… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=273) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=275)