# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=285 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 286 --- ## [Cluster currently has \[1000\]/\[1000\] maximum normal shards open](https://discuss.elastic.co/t/cluster-currently-has-1000-1000-maximum-normal-shards-open/354830)
**Author:** [@diselkgd7](https://discuss.elastic.co/u/diselkgd7)\ **Replies:** 5\ **Last updated:** [March 16, 2024, 9:51am UTC](https://discuss.elastic.co/t/cluster-currently-has-1000-1000-maximum-normal-shards-open/354830 "2024-03-16T09:51:38Z")
I have what is like a Newbee question, I hope it makes sense how I explain it. I noticed that logs are not being ingested by my 1 node cluster and logstash complains about the maximum normal shards open - can you help m… --- ## [Inconsistencies in value count aggregation](https://discuss.elastic.co/t/inconsistencies-in-value-count-aggregation/355308)
**Author:** [@Atefeh](https://discuss.elastic.co/u/Atefeh)\ **Replies:** 3\ **Last updated:** [March 16, 2024, 8:10am UTC](https://discuss.elastic.co/t/inconsistencies-in-value-count-aggregation/355308 "2024-03-16T08:10:56Z")
I am using the Value count aggregation on a fixed interval, (the shards data doesn't change within this interval). However, I am encountering varying results with each query execution. Is it possible that I am obtaining … --- ## [How can I resolve issues with updating nested objects in Elasticsearch DSL within Django Rest Framework?](https://discuss.elastic.co/t/how-can-i-resolve-issues-with-updating-nested-objects-in-elasticsearch-dsl-within-django-rest-framework/355531)
**Author:** [@Manikandan\_FMJ](https://discuss.elastic.co/u/Manikandan_FMJ)\ **Replies:** 0\ **Last updated:** [March 16, 2024, 7:32am UTC](https://discuss.elastic.co/t/how-can-i-resolve-issues-with-updating-nested-objects-in-elasticsearch-dsl-within-django-rest-framework/355531 "2024-03-16T07:32:31Z")
When updating nested objects in Django Rest Framework (DRF), they might be stored as objects instead of Nested, causing issues during search queries. How can I resolve this issue? View file from .details\_document impor… --- ## [How can I upgrade the ELK from 8.5.1 to 8.11.4 \[Docker\] without losing data?](https://discuss.elastic.co/t/how-can-i-upgrade-the-elk-from-8-5-1-to-8-11-4-docker-without-losing-data/355045)
**Author:** [@SamuelSMendes](https://discuss.elastic.co/u/SamuelSMendes)\ **Replies:** 2\ **Last updated:** [March 15, 2024, 8:01pm UTC](https://discuss.elastic.co/t/how-can-i-upgrade-the-elk-from-8-5-1-to-8-11-4-docker-without-losing-data/355045 "2024-03-15T20:01:20Z")
I have this cluster on premisse and would like to upgrade the version but as it is on Docker I'm not sure on how I could keep the older data into the newest version. --- ## [Unable to enable port 5044 for logstash](https://discuss.elastic.co/t/unable-to-enable-port-5044-for-logstash/355449)
**Author:** [@Quan\_Chu](https://discuss.elastic.co/u/Quan_Chu)\ **Replies:** 3\ **Last updated:** [March 15, 2024, 7:32pm UTC](https://discuss.elastic.co/t/unable-to-enable-port-5044-for-logstash/355449 "2024-03-15T19:32:28Z")
here is my config: input { beats { port =\> 5044 } } filter { if \[fileset\]\[module\] == "system" { if \[fileset\]\[name\] == "auth" { grok { match =\> { "message" =\> \["%{SYSLOGTIMESTAMP:\[system\]\[auth\]\[timestamp\]} %{SYS… --- ## [Trouble Matching nested objects with multi\_match Query Using Wildcards in Elasticsearch](https://discuss.elastic.co/t/trouble-matching-nested-objects-with-multi-match-query-using-wildcards-in-elasticsearch/355513)
**Author:** [@Morzaram](https://discuss.elastic.co/u/Morzaram)\ **Replies:** 1\ **Last updated:** [March 15, 2024, 5:56pm UTC](https://discuss.elastic.co/t/trouble-matching-nested-objects-with-multi-match-query-using-wildcards-in-elasticsearch/355513 "2024-03-15T17:56:53Z")
Hey everyone, I'm encountering an issue where my documents aren't being matched by a multi\_match query when I include a wildcard with the search string. I'm trying to search across multiple fields, including nested name… --- ## [Missing data when logstash Aggregate](https://discuss.elastic.co/t/missing-data-when-logstash-aggregate/355511)
**Author:** [@Minh\_S\_D](https://discuss.elastic.co/u/Minh_S_D)\ **Replies:** 2\ **Last updated:** [March 15, 2024, 5:06pm UTC](https://discuss.elastic.co/t/missing-data-when-logstash-aggregate/355511 "2024-03-15T17:06:48Z")
Input: Output: Code: Can someone explain to me why am i missing data? --- ## [Sincedb minor device number changes in Linux VM | alternative sincedb configurations options?](https://discuss.elastic.co/t/sincedb-minor-device-number-changes-in-linux-vm-alternative-sincedb-configurations-options/355506)
**Author:** [@flomickl](https://discuss.elastic.co/u/flomickl)\ **Replies:** 3\ **Last updated:** [March 15, 2024, 4:56pm UTC](https://discuss.elastic.co/t/sincedb-minor-device-number-changes-in-linux-vm-alternative-sincedb-configurations-options/355506 "2024-03-15T16:56:48Z")
Hi, I have a Logstash -\> Elasticsearch set p. Everything is working as expected, but I have a problem with the sincedb or better with my Linux VM underneath. If I reboot the system, the device number of the partition i… --- ## [Fileset suricata/test is configured but doesn't exist](https://discuss.elastic.co/t/fileset-suricata-test-is-configured-but-doesnt-exist/355510)
**Author:** [@e-ferrari](https://discuss.elastic.co/u/e-ferrari)\ **Replies:** 0\ **Last updated:** [March 15, 2024, 4:42pm UTC](https://discuss.elastic.co/t/fileset-suricata-test-is-configured-but-doesnt-exist/355510 "2024-03-15T16:42:56Z")
Hi, i'm running ELK 8.12.1 on Ubuntu 22.04 LTS. I try to rename a fileset (don't know if this is possible). What i found in the net was this: /etc/filebeat/modules.d/suricata.yml: - module: suricata eve: enabl… --- ## [Index keeps getting deleted](https://discuss.elastic.co/t/index-keeps-getting-deleted/317859)
**Author:** [@shivang.ahd](https://discuss.elastic.co/u/shivang.ahd)\ **Replies:** 26\ **Last updated:** [March 15, 2024, 3:17pm UTC](https://discuss.elastic.co/t/index-keeps-getting-deleted/317859 "2024-03-15T15:17:50Z")
Hi, I am new to elasticsearch. I need to make 140 million entries in elasticsearch. For that i have to keep elasticsearch running. Twice it happened that in the middle of ingesting data, when I am halfway to the numb… --- ## [No logs for current timestamp shown in Disover tab](https://discuss.elastic.co/t/no-logs-for-current-timestamp-shown-in-disover-tab/355018)
**Author:** [@Ravi\_Pattar](https://discuss.elastic.co/u/Ravi_Pattar)\ **Replies:** 23\ **Last updated:** [March 15, 2024, 3:06pm UTC](https://discuss.elastic.co/t/no-logs-for-current-timestamp-shown-in-disover-tab/355018 "2024-03-15T15:06:04Z")
Hello, Most recently the security feature (xpack.security) was enabled and the changes were only in the elasticsearch.yml and kibana.yml. Because of this change it was possible to have the authentication while accessing… --- ## [How can I resolve issues with updating nested objects in Elasticsearch DSL within Django Rest Framework?](https://discuss.elastic.co/t/how-can-i-resolve-issues-with-updating-nested-objects-in-elasticsearch-dsl-within-django-rest-framework/355501)
**Author:** [@Manikandan\_FMJ](https://discuss.elastic.co/u/Manikandan_FMJ)\ **Replies:** 0\ **Last updated:** [March 15, 2024, 2:49pm UTC](https://discuss.elastic.co/t/how-can-i-resolve-issues-with-updating-nested-objects-in-elasticsearch-dsl-within-django-rest-framework/355501 "2024-03-15T14:49:42Z")
When updating nested objects in Django Rest Framework (DRF), they might be stored as objects instead of Nested, causing issues during search queries. How can I resolve this issue? --- ## [Kibana Stack Monitoring - Metricbeat - Changing status](https://discuss.elastic.co/t/kibana-stack-monitoring-metricbeat-changing-status/355480)
**Author:** [@miiroslavkardos](https://discuss.elastic.co/u/miiroslavkardos)\ **Replies:** 0\ **Last updated:** [March 15, 2024, 12:19pm UTC](https://discuss.elastic.co/t/kibana-stack-monitoring-metricbeat-changing-status/355480 "2024-03-15T12:19:09Z")
Hello, After upgrade from 7.5.2 to 7.17.17 I set monitoring with metricbeat. It all working fine, index patter is created and i can see all stats from servers. However when i go to Managment -\> Stack Monitoring and En… --- ## [Dynamically show columns in a Discover table by wildcard matching](https://discuss.elastic.co/t/dynamically-show-columns-in-a-discover-table-by-wildcard-matching/355477)
**Author:** [@melkamar](https://discuss.elastic.co/u/melkamar)\ **Replies:** 0\ **Last updated:** [March 15, 2024, 11:55am UTC](https://discuss.elastic.co/t/dynamically-show-columns-in-a-discover-table-by-wildcard-matching/355477 "2024-03-15T11:55:40Z")
Hi, I am wondering if Kibana supports my use case. I am creating a dashboard where I want to show app usage metrics data. The individual documents are pretty small (about 5-10 fields). Some of the fields are common to al… --- ## [Elastic .ml job not rendering all the sources defined in datafeed](https://discuss.elastic.co/t/elastic-ml-job-not-rendering-all-the-sources-defined-in-datafeed/355475)
**Author:** [@Amartya](https://discuss.elastic.co/u/Amartya)\ **Replies:** 0\ **Last updated:** [March 15, 2024, 11:30am UTC](https://discuss.elastic.co/t/elastic-ml-job-not-rendering-all-the-sources-defined-in-datafeed/355475 "2024-03-15T11:30:45Z")
I have this .ml job created which is intended to tap into each of the source integrations we have and monitor for any abnormal dips of document ingestion into the respective index alias (each alias for each integration).… --- ## [Dateformat with milliseconds and Zimezone](https://discuss.elastic.co/t/dateformat-with-milliseconds-and-zimezone/355460)
**Author:** [@helldunkel](https://discuss.elastic.co/u/helldunkel)\ **Replies:** 2\ **Last updated:** [March 15, 2024, 11:26am UTC](https://discuss.elastic.co/t/dateformat-with-milliseconds-and-zimezone/355460 "2024-03-15T11:26:12Z")
Hi, my timestamp is "2024-03-15T01:14:42.429088+01:00" but no pattern work for me. yyyy-MM-dd'T'HH:mm:ss.SSSSSSX yyyy-MM-dd'T'HH:mm:ss.SSSSSSZ yyyy-MM-ddTHH:mm:ss.ssssssTZD YYYY-MM-DDTHH:MM:SS.ssssss±HH:MM can anyb… --- ## [Filebeat AWS-S3 input "multiple json fields found"](https://discuss.elastic.co/t/filebeat-aws-s3-input-multiple-json-fields-found/355457)
**Author:** [@GabrielCInv](https://discuss.elastic.co/u/GabrielCInv)\ **Replies:** 0\ **Last updated:** [March 15, 2024, 9:18am UTC](https://discuss.elastic.co/t/filebeat-aws-s3-input-multiple-json-fields-found/355457 "2024-03-15T09:18:07Z")
I'm using input type AWS-S3 to fetch S3 objects, and I'm getting them from a SQS notification. These objects are log group streams from CloudWatch, which are logs from a Lambda function. The problem is that I'm getting… --- ## [Mapping elastic query response to POCOs in NEST](https://discuss.elastic.co/t/mapping-elastic-query-response-to-pocos-in-nest/355458)
**Author:** [@Daniel\_Makos](https://discuss.elastic.co/u/Daniel_Makos)\ **Replies:** 0\ **Last updated:** [March 15, 2024, 9:18am UTC](https://discuss.elastic.co/t/mapping-elastic-query-response-to-pocos-in-nest/355458 "2024-03-15T09:18:15Z")
Following up on this question here: How to map C# DateTime property to @timestamp field I initialize the Elastic connection: ElasticsearchClientSettings settings; using (settings = new ElasticsearchClientSe… --- ## [Build rpm package with ES source file elasticsearch-8.12.1-linux-x86\_64.tar.gz file excluding jdk , so that I can reduce its size](https://discuss.elastic.co/t/build-rpm-package-with-es-source-file-elasticsearch-8-12-1-linux-x86-64-tar-gz-file-excluding-jdk-so-that-i-can-reduce-its-size/355429)
**Author:** [@Varinder](https://discuss.elastic.co/u/Varinder)\ **Replies:** 5\ **Last updated:** [March 15, 2024, 8:51am UTC](https://discuss.elastic.co/t/build-rpm-package-with-es-source-file-elasticsearch-8-12-1-linux-x86-64-tar-gz-file-excluding-jdk-so-that-i-can-reduce-its-size/355429 "2024-03-15T08:51:32Z")
I have downloaded ES source file elasticsearch-8.12.1-linux-x86\_64.tar.gz file which has all binaries, libraries, jdk and Modules etcetera. I have tried to build rpm package I am getting error . I am following this lin… --- ## [How to get the match records based on two tables in same indices](https://discuss.elastic.co/t/how-to-get-the-match-records-based-on-two-tables-in-same-indices/355368)
**Author:** [@Tqvenkata](https://discuss.elastic.co/u/Tqvenkata)\ **Replies:** 1\ **Last updated:** [March 15, 2024, 7:45am UTC](https://discuss.elastic.co/t/how-to-get-the-match-records-based-on-two-tables-in-same-indices/355368 "2024-03-15T07:45:16Z")
Hi , I need to get the output based on join condition tokenaccess.token with employee table and token access table (like sql join) please find the sample mapping and data PUT joinindex/\_mapping { "properties": { … --- ## [Using a Kibana Dashboard as the basis for a new Canvas Workpad Report](https://discuss.elastic.co/t/using-a-kibana-dashboard-as-the-basis-for-a-new-canvas-workpad-report/355452)
**Author:** [@tristanr](https://discuss.elastic.co/u/tristanr)\ **Replies:** 0\ **Last updated:** [March 15, 2024, 3:57am UTC](https://discuss.elastic.co/t/using-a-kibana-dashboard-as-the-basis-for-a-new-canvas-workpad-report/355452 "2024-03-15T03:57:11Z")
I have an existing Kibana Dashboard that I would like to use as the basis for creating a Canvas Workpad Report. Is there any easy way to do this? I have tried saving the individual visualisations in the Library and addi… --- ## [Working set memory High](https://discuss.elastic.co/t/working-set-memory-high/355215)
**Author:** [@Kesavan\_raina](https://discuss.elastic.co/u/Kesavan_raina)\ **Replies:** 6\ **Last updated:** [March 15, 2024, 3:52am UTC](https://discuss.elastic.co/t/working-set-memory-high/355215 "2024-03-15T03:52:48Z")
Hi all, I'm running an Elasticsearch cluster with just one node JVM configuration uses the default values with -Xms 2g -Xmx 2g but when I checked the memory usage I saw that the working set memory value is up to 25gb… --- ## [How to delete an unassigned primary shard](https://discuss.elastic.co/t/how-to-delete-an-unassigned-primary-shard/355446)
**Author:** [@Churchill](https://discuss.elastic.co/u/Churchill)\ **Replies:** 1\ **Last updated:** [March 15, 2024, 3:50am UTC](https://discuss.elastic.co/t/how-to-delete-an-unassigned-primary-shard/355446 "2024-03-15T03:50:46Z")
Good day, We're currently experiencing an issue with one of our index (let's call it sample\_index) which has 21 primary shards with 1 replica. The primary shards of sample\_index are distributed on all our nodes. Unfortu… --- ## [This field does not work with the selected function](https://discuss.elastic.co/t/this-field-does-not-work-with-the-selected-function/355365)
**Author:** [@vanhaiit90](https://discuss.elastic.co/u/vanhaiit90)\ **Replies:** 6\ **Last updated:** [March 15, 2024, 3:45am UTC](https://discuss.elastic.co/t/this-field-does-not-work-with-the-selected-function/355365 "2024-03-15T03:45:19Z")
I have a dashboard but I don't understand why the field status\_request seem is error Please help me resolve the above error --- ## [Order of processing: Input from Kafka, output to file](https://discuss.elastic.co/t/order-of-processing-input-from-kafka-output-to-file/355442)
**Author:** [@ankh](https://discuss.elastic.co/u/ankh)\ **Replies:** 1\ **Last updated:** [March 15, 2024, 1:07am UTC](https://discuss.elastic.co/t/order-of-processing-input-from-kafka-output-to-file/355442 "2024-03-15T01:07:51Z")
I am debugging a pipeline that has input from Kafka and output to Elasticsearch. As part of the debugging I'm writing to a file using the file output plugin. The Kafka topic is a single partition. This simplified confi… --- ## [Master only node Volume size](https://discuss.elastic.co/t/master-only-node-volume-size/355345)
**Author:** [@pop2413](https://discuss.elastic.co/u/pop2413)\ **Replies:** 4\ **Last updated:** [March 14, 2024, 11:49pm UTC](https://discuss.elastic.co/t/master-only-node-volume-size/355345 "2024-03-14T23:49:02Z")
Hello, I try to configure ES cluster using 4 nodes (1 master only node, 3 data only nodes) but, I'm not sure how much to set the volume size for the master node. (The volume is mounted on /usr/share/elasticsearch/dat… --- ## [Need help on DateHistogram queries](https://discuss.elastic.co/t/need-help-on-datehistogram-queries/355430)
**Author:** [@Laksh\_0009](https://discuss.elastic.co/u/Laksh_0009)\ **Replies:** 0\ **Last updated:** [March 14, 2024, 5:02pm UTC](https://discuss.elastic.co/t/need-help-on-datehistogram-queries/355430 "2024-03-14T17:02:09Z")
I need a help in building a query, I have two time fields in a index in same formats, First I need to groupBy "returnCompletedDate" field but by rounding the time part to 00:00:00, like "2024-02-21 12:00:00" will be "… --- ## [Filebeat 8.12.2 (with kubernetes hints-based autodiscover and kafka output) apparently leaks memory](https://discuss.elastic.co/t/filebeat-8-12-2-with-kubernetes-hints-based-autodiscover-and-kafka-output-apparently-leaks-memory/355225)
**Author:** [@VannTen](https://discuss.elastic.co/u/VannTen)\ **Replies:** 4\ **Last updated:** [March 14, 2024, 4:34pm UTC](https://discuss.elastic.co/t/filebeat-8-12-2-with-kubernetes-hints-based-autodiscover-and-kafka-output-apparently-leaks-memory/355225 "2024-03-14T16:34:34Z")
Hi. We're running the following configuration of filebeat apiVersion: apps/v1 kind: DaemonSet metadata: name: REDACTED-filebeat-filebeat spec: ... REDACTED template: metadata: REDATCED spec: contain… --- ## [Pub/Sub integration with JSON Processor: "Cannot index event (status=400): dropping event! Enable debug logs to view the event and cause."](https://discuss.elastic.co/t/pub-sub-integration-with-json-processor-cannot-index-event-status-400-dropping-event-enable-debug-logs-to-view-the-event-and-cause/354760)
**Author:** [@tommed](https://discuss.elastic.co/u/tommed)\ **Replies:** 12\ **Last updated:** [March 14, 2024, 3:57pm UTC](https://discuss.elastic.co/t/pub-sub-integration-with-json-processor-cannot-index-event-status-400-dropping-event-enable-debug-logs-to-view-the-event-and-cause/354760 "2024-03-14T15:57:11Z")
I have created a Pub/Sub integration instance which imports data from a topic and ingests it into Elastic. This part works as expected. If I then re-configure the integration and specify a custom ingest pipeline (which … --- ## [Logstash config for windows events](https://discuss.elastic.co/t/logstash-config-for-windows-events/355421)
**Author:** [@deanj](https://discuss.elastic.co/u/deanj)\ **Replies:** 0\ **Last updated:** [March 14, 2024, 3:36pm UTC](https://discuss.elastic.co/t/logstash-config-for-windows-events/355421 "2024-03-14T15:36:22Z")
Hi All, I'm very new to logstash, so i'm new to manually configuring its config for event filtering. What i am planning: 1: Collect windows events. Sent from a remote location by windows event forwarding service on … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=284) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=286)