# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=334 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 335 --- ## [Index\_not\_found\_exception](https://discuss.elastic.co/t/index-not-found-exception/350736)
**Author:** [@e-ferrari](https://discuss.elastic.co/u/e-ferrari)\ **Replies:** 2\ **Last updated:** [January 11, 2024, 4:57pm UTC](https://discuss.elastic.co/t/index-not-found-exception/350736 "2024-01-11T16:57:55Z")
Hi, i'm following Parsing Logs with Logstash | Logstash Reference \[8.11\] | Elastic. When i try, as mentioned in the text curl -k -u elastic:xxxxxxxxxxxxxxxxxxxxx -XGET 'https://localhost:9200/2024.01.10/\_search?pretty&q… --- ## [Error: can not write type \[class java.time.LocalDate\] - Elasticsearch v8.10](https://discuss.elastic.co/t/error-can-not-write-type-class-java-time-localdate-elasticsearch-v8-10/350868)
**Author:** [@Abhishek](https://discuss.elastic.co/u/Abhishek)\ **Replies:** 0\ **Last updated:** [January 11, 2024, 2:39pm UTC](https://discuss.elastic.co/t/error-can-not-write-type-class-java-time-localdate-elasticsearch-v8-10/350868 "2024-01-11T14:39:34Z")
Hi Everyone, I have recently upgraded from es 5.6 to es 8.10. Following script field is working fine in es5.6 "script\_fields": { "customDate": { "script": { "inline": "def i ; if(params.\_source.cu… --- ## [What is the recommended memory:data ratio for a cold zone?](https://discuss.elastic.co/t/what-is-the-recommended-memory-data-ratio-for-a-cold-zone/349755)
**Author:** [@calin](https://discuss.elastic.co/u/calin)\ **Replies:** 8\ **Last updated:** [January 11, 2024, 1:31pm UTC](https://discuss.elastic.co/t/what-is-the-recommended-memory-data-ratio-for-a-cold-zone/349755 "2024-01-11T13:31:48Z")
I see for the hot zone it's 30. For a warm zone it's 160. I haven't seen a value for cold zone. And how exactly is that calculated ? Thank you. --- ## [Windows two Node Cluster stuck on tring to determine master](https://discuss.elastic.co/t/windows-two-node-cluster-stuck-on-tring-to-determine-master/350691)
**Author:** [@bytelink](https://discuss.elastic.co/u/bytelink)\ **Replies:** 11\ **Last updated:** [January 11, 2024, 1:28pm UTC](https://discuss.elastic.co/t/windows-two-node-cluster-stuck-on-tring-to-determine-master/350691 "2024-01-11T13:28:07Z")
I have been trying to install a new two node cluster on two windows servers and no matter what I have tried I get a situation where the two nodes do not seem to be able to determine which should be the master. I have tr… --- ## [TLS/SSL Certification](https://discuss.elastic.co/t/tls-ssl-certification/350859)
**Author:** [@jhanani](https://discuss.elastic.co/u/jhanani)\ **Replies:** 0\ **Last updated:** [January 11, 2024, 12:58pm UTC](https://discuss.elastic.co/t/tls-ssl-certification/350859 "2024-01-11T12:58:00Z")
I am running Elasticsearch and Kibana 8.11.3 version on ubuntu VM using docker. If I try to connect the Elasticsearch with PowerBI through API key. It is showing the below error. Error Message: -"The underlying connect… --- ## [Single Node Cluster - Basic or Minimal Security](https://discuss.elastic.co/t/single-node-cluster-basic-or-minimal-security/350586)
**Author:** [@randomnamegenerator](https://discuss.elastic.co/u/randomnamegenerator)\ **Replies:** 7\ **Last updated:** [January 11, 2024, 12:37pm UTC](https://discuss.elastic.co/t/single-node-cluster-basic-or-minimal-security/350586 "2024-01-11T12:37:41Z")
Hello All, I am looking for a little best practice guidance for our single node cluster on a customer site. The main aim is to create roles in kibana so that we can lock down access to certain individuals and groups. M… --- ## [Update jsonString with UpdateRequest through new java client\[8+ version\]](https://discuss.elastic.co/t/update-jsonstring-with-updaterequest-through-new-java-client-8-version/350855)
**Author:** [@pankaj\_sen](https://discuss.elastic.co/u/pankaj_sen)\ **Replies:** 0\ **Last updated:** [January 11, 2024, 12:31pm UTC](https://discuss.elastic.co/t/update-jsonstring-with-updaterequest-through-new-java-client-8-version/350855 "2024-01-11T12:31:47Z")
Getting below error while trying to update json string through update request. \[x\_content\_parse\_exception\] \[1:8\] \[UpdateRequest\] doc doesn't support values of type: VALUE\_STRING Below is my code snnipt client.update(g… --- ## [Kibana server is not ready yet](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/350771)
**Author:** [@boubou](https://discuss.elastic.co/u/boubou)\ **Replies:** 1\ **Last updated:** [January 11, 2024, 11:50am UTC](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/350771 "2024-01-11T11:50:39Z")
I am trying to set up an ELK stack with communication between Kibana and Elasticsearch. I am new to ELK and I am having trouble. I will present my configurations and the results that I am getting. To start, I downloaded… --- ## [Kibana will not connect to elasticsearch](https://discuss.elastic.co/t/kibana-will-not-connect-to-elasticsearch/350773)
**Author:** [@Scott\_Barker](https://discuss.elastic.co/u/Scott_Barker)\ **Replies:** 1\ **Last updated:** [January 11, 2024, 11:34am UTC](https://discuss.elastic.co/t/kibana-will-not-connect-to-elasticsearch/350773 "2024-01-11T11:34:14Z")
When I connect via a web browser I get the error ‘Kibana server is not ready’ I’ve configured elastic with Windows certificates, I can connect to the elk cluster OK that looks OK. https://elkcluster9200/\_cluster/health … --- ## [Logstash date parse issue with date filter using csv file input plugin](https://discuss.elastic.co/t/logstash-date-parse-issue-with-date-filter-using-csv-file-input-plugin/350850)
**Author:** [@jgregory\_tc](https://discuss.elastic.co/u/jgregory_tc)\ **Replies:** 0\ **Last updated:** [January 11, 2024, 11:23am UTC](https://discuss.elastic.co/t/logstash-date-parse-issue-with-date-filter-using-csv-file-input-plugin/350850 "2024-01-11T11:23:30Z")
Hoping someone can assist me with my issue below: I have Logstash conf setup to use the csv input plugin. The data inputs a date field with value like follows… 2024-01-09 22:21:04 I then have this logic in the filter … --- ## [Elastic Unstable](https://discuss.elastic.co/t/elastic-unstable/350593)
**Author:** [@Dea\_Agra](https://discuss.elastic.co/u/Dea_Agra)\ **Replies:** 16\ **Last updated:** [January 11, 2024, 10:38am UTC](https://discuss.elastic.co/t/elastic-unstable/350593 "2024-01-11T10:38:34Z")
Hi Team Elastic, I have been stressful latelty because my logs are coming to Elasticsearch delay for about 10 hours. I have 3 nodes, Node 1: master, ingest, transform, resource: 16vCPU, 16GB, 500GB Node 2: data\_hot, … --- ## [Elasticsearch doesn't work!](https://discuss.elastic.co/t/elasticsearch-doesnt-work/350842)
**Author:** [@boubou](https://discuss.elastic.co/u/boubou)\ **Replies:** 1\ **Last updated:** [January 11, 2024, 10:28am UTC](https://discuss.elastic.co/t/elasticsearch-doesnt-work/350842 "2024-01-11T10:28:20Z")
I am having difficulties using Elasticsearch. I am on Linux and I have installed Elasticsearch 8.2. I have modified my elasticsearch.yml and here is what it contains: cluster.name: elasticsearch-prod node.name: myserve… --- ## [What's the best way to create the combined fields in Elastic Search?](https://discuss.elastic.co/t/whats-the-best-way-to-create-the-combined-fields-in-elastic-search/350843)
**Author:** [@Nomerator](https://discuss.elastic.co/u/Nomerator)\ **Replies:** 0\ **Last updated:** [January 11, 2024, 10:02am UTC](https://discuss.elastic.co/t/whats-the-best-way-to-create-the-combined-fields-in-elastic-search/350843 "2024-01-11T10:02:49Z")
For example, I have fields street, city, state, continent, planet. There is situation when I should search by combination of two fields street and city, and there is situation when I should search by combination of all … --- ## [ILM Hot, Warm, Cold not moving indexes](https://discuss.elastic.co/t/ilm-hot-warm-cold-not-moving-indexes/350756)
**Author:** [@DaddyYusk](https://discuss.elastic.co/u/DaddyYusk)\ **Replies:** 3\ **Last updated:** [January 11, 2024, 9:25am UTC](https://discuss.elastic.co/t/ilm-hot-warm-cold-not-moving-indexes/350756 "2024-01-11T09:25:26Z")
Hi, Despite the ILM policy applied to all logs (Managed), the indexes are moved to the Warm node but not deleted on the Hot node and I'm actually reaching disk capacity on the Hot node... Here is my Elastic Cluster : w… --- ## [K8s daemonset filebeat stop harvesting log after a while](https://discuss.elastic.co/t/k8s-daemonset-filebeat-stop-harvesting-log-after-a-while/350839)
**Author:** [@sailorqh0321](https://discuss.elastic.co/u/sailorqh0321)\ **Replies:** 0\ **Last updated:** [January 11, 2024, 9:07am UTC](https://discuss.elastic.co/t/k8s-daemonset-filebeat-stop-harvesting-log-after-a-while/350839 "2024-01-11T09:07:26Z")
k8s daemonset filebeat stop harvesting log after a while. I started daemonset filebeat in my k8s cluster to collect my Java logs filebeat-version: 8.3.3 My configmap content is as follows --- apiVersion: v1 kind: Con… --- ## [Need help deciding how to partition data](https://discuss.elastic.co/t/need-help-deciding-how-to-partition-data/350837)
**Author:** [@favoca](https://discuss.elastic.co/u/favoca)\ **Replies:** 1\ **Last updated:** [January 11, 2024, 8:44am UTC](https://discuss.elastic.co/t/need-help-deciding-how-to-partition-data/350837 "2024-01-11T08:44:05Z")
The document in my RDMS has a schema similar to this: { PatientId: "string", Date: "date", IsAvailable: "bool", \_hospitalId: "6-digit number which can be a number or a string" } The \_hospitalId acts like a partition ke… --- ## [Time difference calculation in vega](https://discuss.elastic.co/t/time-difference-calculation-in-vega/350820)
**Author:** [@hoodaiy](https://discuss.elastic.co/u/hoodaiy)\ **Replies:** 0\ **Last updated:** [January 11, 2024, 6:07am UTC](https://discuss.elastic.co/t/time-difference-calculation-in-vega/350820 "2024-01-11T06:07:35Z")
hello everyone, i want to calculate the time difference between "startTimestamp" and "endTimestamp", where the filters created for each match. i think i'm getting an issue while connecting to the source, as i'm getting… --- ## [Visualization - matching on a condition](https://discuss.elastic.co/t/visualization-matching-on-a-condition/350795)
**Author:** [@radio\_1](https://discuss.elastic.co/u/radio_1)\ **Replies:** 1\ **Last updated:** [January 11, 2024, 12:42am UTC](https://discuss.elastic.co/t/visualization-matching-on-a-condition/350795 "2024-01-11T00:42:24Z")
Hi - very new to Kibana and visualizations. I have a number of hosts reporting a bunch of objects, each containing a field with a "yes" or "no" value. I'm trying to create a visualization with timestamp on the H-axis a… --- ## [Creating Mappings for Index Interconnections in ElasticSearch: How to Establish Relationships Between Tables?](https://discuss.elastic.co/t/creating-mappings-for-index-interconnections-in-elasticsearch-how-to-establish-relationships-between-tables/350749)
**Author:** [@Neelesh\_Gupta](https://discuss.elastic.co/u/Neelesh_Gupta)\ **Replies:** 2\ **Last updated:** [January 11, 2024, 12:21am UTC](https://discuss.elastic.co/t/creating-mappings-for-index-interconnections-in-elasticsearch-how-to-establish-relationships-between-tables/350749 "2024-01-11T00:21:22Z")
I've successfully uploaded 10 CSV file as tables to Elasticsearch to create a Kibana dashboard. However, since these tables are interlinked with foreign keys, they have been transformed into JSON (NoSQL) format in elasti… --- ## [Elasticsearch unable to form a cluster](https://discuss.elastic.co/t/elasticsearch-unable-to-form-a-cluster/350798)
**Author:** [@ido.shoy](https://discuss.elastic.co/u/ido.shoy)\ **Replies:** 0\ **Last updated:** [January 11, 2024, 12:00am UTC](https://discuss.elastic.co/t/elasticsearch-unable-to-form-a-cluster/350798 "2024-01-11T00:00:55Z")
this is my docker-compose.yml version: '3.8' services: els01: image: docker.elastic.co/elasticsearch/elasticsearch:8.11.3 hostname: els01 volumes: - /mnt/data/els01:/usr/share/e… --- ## [I have error in logstash](https://discuss.elastic.co/t/i-have-error-in-logstash/350790)
**Author:** [@ahmedtamawe](https://discuss.elastic.co/u/ahmedtamawe)\ **Replies:** 1\ **Last updated:** [January 10, 2024, 8:50pm UTC](https://discuss.elastic.co/t/i-have-error-in-logstash/350790 "2024-01-10T20:50:34Z")
i have this error and want to solve it --- ## [Logs received from panorama](https://discuss.elastic.co/t/logs-received-from-panorama/350785)
**Author:** [@juancamiloll](https://discuss.elastic.co/u/juancamiloll)\ **Replies:** 2\ **Last updated:** [January 10, 2024, 8:41pm UTC](https://discuss.elastic.co/t/logs-received-from-panorama/350785 "2024-01-10T20:41:25Z")
Hello everyone, Normally when I do the ELK installation I ask the firewall administrators to send the logs via port 514 TPC to the server I administer. In the server what I do is that I modify the rsyslog.com file to o… --- ## [Shard Count based on incomming data (MBits/sec) or max MBits/sec of Node (datastream included)?](https://discuss.elastic.co/t/shard-count-based-on-incomming-data-mbits-sec-or-max-mbits-sec-of-node-datastream-included/350788)
**Author:** [@LaszloE](https://discuss.elastic.co/u/LaszloE)\ **Replies:** 0\ **Last updated:** [January 10, 2024, 8:20pm UTC](https://discuss.elastic.co/t/shard-count-based-on-incomming-data-mbits-sec-or-max-mbits-sec-of-node-datastream-included/350788 "2024-01-10T20:20:12Z")
Let us say I have 300 GB data coming in from one client in a day. I store this data on the hot nodes and at the end of the day I move it to the warm nodes. For this 300 GB in order to have acceptable sized shards (let … --- ## [Elastic search 8.7.1 cluster is not forming, Here is yml: and command to create a token run on CENTOS7](https://discuss.elastic.co/t/elastic-search-8-7-1-cluster-is-not-forming-here-is-yml-and-command-to-create-a-token-run-on-centos7/350613)
**Author:** [@Varinder](https://discuss.elastic.co/u/Varinder)\ **Replies:** 9\ **Last updated:** [January 10, 2024, 7:10pm UTC](https://discuss.elastic.co/t/elastic-search-8-7-1-cluster-is-not-forming-here-is-yml-and-command-to-create-a-token-run-on-centos7/350613 "2024-01-10T19:10:56Z")
path.data: /var/lib/elasticsearch path.logs: /var/log/elasticsearch xpack.security.enabled: false xpack.security.enrollment.enabled: true xpack.security.http.ssl: enabled: false keystore.path: certs/http.p12 xpack… --- ## [How to extract the time stamp from](https://discuss.elastic.co/t/how-to-extract-the-time-stamp-from/348741)
**Author:** [@pero](https://discuss.elastic.co/u/pero)\ **Replies:** 20\ **Last updated:** [January 10, 2024, 5:24pm UTC](https://discuss.elastic.co/t/how-to-extract-the-time-stamp-from/348741 "2024-01-10T17:24:43Z")
Hi All, Please I need help on how to extract the timestamp from "type=SYSCALL msg=audit(1701877882.123:5786893): " in the below code using grok filter { "\_index": "auditbeat-2023.12.06", "\_type": "\_doc", "\_id": "… --- ## [Creating Mappings for Index Interconnections in ElasticSearch: How to Establish Relationships Between Tables?](https://discuss.elastic.co/t/creating-mappings-for-index-interconnections-in-elasticsearch-how-to-establish-relationships-between-tables/350751)
**Author:** [@Neelesh\_Gupta](https://discuss.elastic.co/u/Neelesh_Gupta)\ **Replies:** 1\ **Last updated:** [January 10, 2024, 5:12pm UTC](https://discuss.elastic.co/t/creating-mappings-for-index-interconnections-in-elasticsearch-how-to-establish-relationships-between-tables/350751 "2024-01-10T17:12:53Z")
I've uploaded 10 CSV tables to Elasticsearch to create a Kibana dashboard. However, since these tables are interlinked with foreign keys, they have been transformed into JSON (NoSQL) format. I'm now looking for guidance … --- ## [Nagios Log Server: Cannot login](https://discuss.elastic.co/t/nagios-log-server-cannot-login/350780)
**Author:** [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Replies:** 0\ **Last updated:** [January 10, 2024, 5:04pm UTC](https://discuss.elastic.co/t/nagios-log-server-cannot-login/350780 "2024-01-10T17:04:38Z")
Hello Im using Nagios Log Server (which is ELK) and the issue Im having is that when I point the data directory to a NFS share, it says invalid username or password. Doesnt matter if I even reset it, it says the same th… --- ## [I have a question about packetbeat character encoding](https://discuss.elastic.co/t/i-have-a-question-about-packetbeat-character-encoding/350637)
**Author:** [@67PNV5pp1gS6q53B](https://discuss.elastic.co/u/67PNV5pp1gS6q53B)\ **Replies:** 5\ **Last updated:** [January 10, 2024, 3:50pm UTC](https://discuss.elastic.co/t/i-have-a-question-about-packetbeat-character-encoding/350637 "2024-01-10T15:50:31Z")
I want to capture the request and return of the http port, but the data returned by http contains Chinese characters and uses GBK encoding. Garbled characters appear after packetbeat is sent to elastic. I did not find th… --- ## [Can we assign colors to specific fields in kibana?](https://discuss.elastic.co/t/can-we-assign-colors-to-specific-fields-in-kibana/327624)
**Author:** [@smchamberlin](https://discuss.elastic.co/u/smchamberlin)\ **Replies:** 10\ **Last updated:** [January 10, 2024, 3:32pm UTC](https://discuss.elastic.co/t/can-we-assign-colors-to-specific-fields-in-kibana/327624 "2024-01-10T15:32:00Z")
Hello, I can see how to select a color palette for a kibanaq dashboard lens visualization, but what I'd really like to be able to do is choose a particular field (like a "bad" field) and assign it red, and choose a "goo… --- ## [Podman containers wont start after creating podman-compose](https://discuss.elastic.co/t/podman-containers-wont-start-after-creating-podman-compose/350483)
**Author:** [@Mike\_Kirby](https://discuss.elastic.co/u/Mike_Kirby)\ **Replies:** 2\ **Last updated:** [January 10, 2024, 2:55pm UTC](https://discuss.elastic.co/t/podman-containers-wont-start-after-creating-podman-compose/350483 "2024-01-10T14:55:24Z")
Hello Elastic Guru's. I am back with a new and exciting question. I am in a new project, where I am running a Podman/Docker configuration for my Elastic SIEM. I have the Kibana and Logstash installed and their contain… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=333) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=335)