# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=396 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 397 --- ## [Security error creating cluster](https://discuss.elastic.co/t/security-error-creating-cluster/345274)
**Author:** [@TIexplorer](https://discuss.elastic.co/u/TIexplorer)\ **Replies:** 0\ **Last updated:** [October 18, 2023, 11:15am UTC](https://discuss.elastic.co/t/security-error-creating-cluster/345274 "2023-10-18T11:15:50Z")
Hello guys, I’m setting up an elastic cluster and getting these errors in the logs, tell me what I’m doing wrong \[2023-10-11T01:00:19,733\]\[WARN \]\[o.e.c.s.DiagnosticTrustManager\] \[ELK-01\] failed to establish trust with s… --- ## [Logstash is restarting when trying to reload certificate](https://discuss.elastic.co/t/logstash-is-restarting-when-trying-to-reload-certificate/345100)
**Author:** [@djrshn2346](https://discuss.elastic.co/u/djrshn2346)\ **Replies:** 8\ **Last updated:** [October 18, 2023, 10:06am UTC](https://discuss.elastic.co/t/logstash-is-restarting-when-trying-to-reload-certificate/345100 "2023-10-18T10:06:18Z")
I am trying to reduce the TTL period to 10 mins and then after 8 mins, the certificate should reload but it does not happens, then it fails and restarts the Logstash, this process restart also fails and the complete pod … --- ## [How to start Metricbeat as non root user?](https://discuss.elastic.co/t/how-to-start-metricbeat-as-non-root-user/344712)
**Author:** [@Gorkem\_Keskin](https://discuss.elastic.co/u/Gorkem_Keskin)\ **Replies:** 1\ **Last updated:** [October 18, 2023, 10:05am UTC](https://discuss.elastic.co/t/how-to-start-metricbeat-as-non-root-user/344712 "2023-10-18T10:05:00Z")
Hello, I am sending logs using Metricbeat system module to Elasticsearch. I have to send as a non root user, however it keeps on sending both as non root and root user. I tried to follow documentations to send only as n… --- ## [409 - version conflict - delete\_by\_query (API request using C# NEST)](https://discuss.elastic.co/t/409-version-conflict-delete-by-query-api-request-using-c-nest/345260)
**Author:** [@rd8388](https://discuss.elastic.co/u/rd8388)\ **Replies:** 6\ **Last updated:** [October 18, 2023, 9:56am UTC](https://discuss.elastic.co/t/409-version-conflict-delete-by-query-api-request-using-c-nest/345260 "2023-10-18T09:56:16Z")
Status: 409 Type: version\_conflict\_engine\_exception Reason: \[My\_Doc\_ID\]: version conflict, required seqNo \[5092680\], primary term \[45\]. current document has seqNo \[5095726\] and primary term \[45\] We are using C# Nes… --- ## [Controlling the size of the point on the map using document](https://discuss.elastic.co/t/controlling-the-size-of-the-point-on-the-map-using-document/345227)
**Author:** [@Erez\_Danieli](https://discuss.elastic.co/u/Erez_Danieli)\ **Replies:** 3\ **Last updated:** [October 18, 2023, 9:22am UTC](https://discuss.elastic.co/t/controlling-the-size-of-the-point-on-the-map-using-document/345227 "2023-10-18T09:22:20Z")
Hello everyone, I was able to control the point color by sending the color code. I tried in a similar way to send a number for the point size, but I have no option to select this field. I would appreciate help with ho… --- ## [AIOps no data views or saved searches found](https://discuss.elastic.co/t/aiops-no-data-views-or-saved-searches-found/344981)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 10\ **Last updated:** [October 18, 2023, 8:59am UTC](https://discuss.elastic.co/t/aiops-no-data-views-or-saved-searches-found/344981 "2023-10-18T08:59:26Z")
Hello, AIOps no data views or saved searches found.. We definitely have data views / saves searches. So why don't we find them? Willem --- ## [Fielddata is disabled on \[host.hostname\] in \[filebeat-8.10.4-2023.10.17\]](https://discuss.elastic.co/t/fielddata-is-disabled-on-host-hostname-in-filebeat-8-10-4-2023-10-17/345246)
**Author:** [@whanklee](https://discuss.elastic.co/u/whanklee)\ **Replies:** 5\ **Last updated:** [October 18, 2023, 8:07am UTC](https://discuss.elastic.co/t/fielddata-is-disabled-on-host-hostname-in-filebeat-8-10-4-2023-10-17/345246 "2023-10-18T08:07:28Z")
Hi there, I got the following error code: Index: filebeat-8.10.4-2023.10.17 Type: illegal\_argument\_exception Node: rQ6bZR\_YQ3Ken74LUR-Oaw Reason: Fielddata is disabled on \[host.hostname\] in \[filebeat-8.10.4-2023.10.… --- ## [How to know when indices mapping was updated](https://discuss.elastic.co/t/how-to-know-when-indices-mapping-was-updated/345046)
**Author:** [@pratik\_jain163](https://discuss.elastic.co/u/pratik_jain163)\ **Replies:** 6\ **Last updated:** [October 18, 2023, 7:58am UTC](https://discuss.elastic.co/t/how-to-know-when-indices-mapping-was-updated/345046 "2023-10-18T07:58:17Z")
hi All, Someone has updated the mapping of any indices, so I want to know how we can find this. And also, is there a way we can get all indices to also get udpated. and if we want to enable auditing in ES how we can d… --- ## [ES failed to connect to master node](https://discuss.elastic.co/t/es-failed-to-connect-to-master-node/344986)
**Author:** [@Genesys\_Bagus](https://discuss.elastic.co/u/Genesys_Bagus)\ **Replies:** 9\ **Last updated:** [October 18, 2023, 6:42am UTC](https://discuss.elastic.co/t/es-failed-to-connect-to-master-node/344986 "2023-10-18T06:42:08Z")
hi team, i have 3 nodes elasticsearch cluster, but at one time elasticsearch couldn't function properly because the master node left (reason = shutdown) \ \[2023-09-13T01:14:28,394\]\[INFO \]\[o.e.n.Node \] … --- ## [Rebalance is Not Working In Elasticsearch](https://discuss.elastic.co/t/rebalance-is-not-working-in-elasticsearch/345003)
**Author:** [@Debasis\_Mallick](https://discuss.elastic.co/u/Debasis_Mallick)\ **Replies:** 4\ **Last updated:** [October 18, 2023, 6:24am UTC](https://discuss.elastic.co/t/rebalance-is-not-working-in-elasticsearch/345003 "2023-10-18T06:24:52Z")
Hi Team, I had below scenario in my Elasticsearch setup. The cluster previously consists of 2 nodes and one index having docs around 125M. I had added one more node to the cluster but the data is not getting distribut… --- ## [Winlogbeat causing high CPU utilization](https://discuss.elastic.co/t/winlogbeat-causing-high-cpu-utilization/344972)
**Author:** [@momher](https://discuss.elastic.co/u/momher)\ **Replies:** 3\ **Last updated:** [October 18, 2023, 6:18am UTC](https://discuss.elastic.co/t/winlogbeat-causing-high-cpu-utilization/344972 "2023-10-18T06:18:59Z")
Winlogbeat is causing high CPU utilization in one of our Domain Controller Server. It happens the same time of the day and it's been re-occurring and alerted 3x for this month. Winlogbeat version - 7.17.9 --- ## [How to Generate a SAML Certificate with OpenSSL on Elastic Cloud?](https://discuss.elastic.co/t/how-to-generate-a-saml-certificate-with-openssl-on-elastic-cloud/345090)
**Author:** [@yago82](https://discuss.elastic.co/u/yago82)\ **Replies:** 1\ **Last updated:** [October 18, 2023, 6:10am UTC](https://discuss.elastic.co/t/how-to-generate-a-saml-certificate-with-openssl-on-elastic-cloud/345090 "2023-10-18T06:10:25Z")
Hi Community, I'm working on configuring SAML authentication for my Elastic Stack deployment, and I've come across the need to generate a SAML certificate and key. The documentation suggests using the openssl req comman… --- ## [JRE with Bouncy Castle for FIPS or is PEM sufficient](https://discuss.elastic.co/t/jre-with-bouncy-castle-for-fips-or-is-pem-sufficient/345144)
**Author:** [@Kris\_U](https://discuss.elastic.co/u/Kris_U)\ **Replies:** 1\ **Last updated:** [October 18, 2023, 6:05am UTC](https://discuss.elastic.co/t/jre-with-bouncy-castle-for-fips-or-is-pem-sufficient/345144 "2023-10-18T06:05:35Z")
I was able to get Elasticsearch working with the Bouncy Castle BCFKS keystore in Elasticsearch 7.17 (I will post the steps at the end of my post). But Kibana and Logstash will not accept the BCFKS keystore format. I am r… --- ## [Index Pattern](https://discuss.elastic.co/t/index-pattern/345214)
**Author:** [@Suleman\_Ahmed](https://discuss.elastic.co/u/Suleman_Ahmed)\ **Replies:** 2\ **Last updated:** [October 18, 2023, 5:40am UTC](https://discuss.elastic.co/t/index-pattern/345214 "2023-10-18T05:40:14Z")
hello! I am running ELK on my kubernetes cluster and unable to create index pattern. Any help will be highly appreciated. My logstash yaml is as under:- apiVersion: v1 kind: ConfigMap metadata: name: logstash-config … --- ## [Logstash-plugin kv useragent question](https://discuss.elastic.co/t/logstash-plugin-kv-useragent-question/345182)
**Author:** [@Mick1](https://discuss.elastic.co/u/Mick1)\ **Replies:** 2\ **Last updated:** [October 18, 2023, 12:53am UTC](https://discuss.elastic.co/t/logstash-plugin-kv-useragent-question/345182 "2023-10-18T00:53:47Z")
Dear ELK technical experts I have a basic logstash kv question to ask, experts please help. message data1:abcde,;,useragent:Mozilla/5.0 (X11; Linux x86\_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Sa… --- ## [ELK service stops when space is limited](https://discuss.elastic.co/t/elk-service-stops-when-space-is-limited/345248)
**Author:** [@juancamiloll](https://discuss.elastic.co/u/juancamiloll)\ **Replies:** 3\ **Last updated:** [October 17, 2023, 11:23pm UTC](https://discuss.elastic.co/t/elk-service-stops-when-space-is-limited/345248 "2023-10-17T23:23:53Z")
Hello, I am working with an old version of ELK 7.6.0. I have detected that sometimes one of the 3 services stops when the disk reaches 94% or 95% of its capacity. I don't know if this is a default setting, I don't know… --- ## [On-prem to Cloud Via Logstash](https://discuss.elastic.co/t/on-prem-to-cloud-via-logstash/345135)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 9\ **Last updated:** [October 17, 2023, 9:01pm UTC](https://discuss.elastic.co/t/on-prem-to-cloud-via-logstash/345135 "2023-10-17T21:01:55Z")
I am moving my logs from an on-prem instance, up to Elastic Cloud. I have setup a logstash pipeline, with a very large persistent queue, like below to push events up to the Cloud. input { elasticsearch { hosts =\> … --- ## [Elasticsearch falsely(?) reporting it has reached the field limit](https://discuss.elastic.co/t/elasticsearch-falsely-reporting-it-has-reached-the-field-limit/343794)
**Author:** [@dpitchford](https://discuss.elastic.co/u/dpitchford)\ **Replies:** 3\ **Last updated:** [October 17, 2023, 5:26pm UTC](https://discuss.elastic.co/t/elasticsearch-falsely-reporting-it-has-reached-the-field-limit/343794 "2023-10-17T17:26:45Z")
When trying to index documents into an Elasticsearch 6.8.22 instance, I am seeing error messages like this: {'index': {'\_index': 'data\_explorer', '\_type': 'flywheel', '\_id': '64ff3d667ed067064bf7bd7e', 'status': 400, 'e… --- ## [Getting next 10k documents with AppSearch.list\_documents()](https://discuss.elastic.co/t/getting-next-10k-documents-with-appsearch-list-documents/345216)
**Author:** [@marc.schwarzschild](https://discuss.elastic.co/u/marc.schwarzschild)\ **Replies:** 5\ **Last updated:** [October 17, 2023, 5:14pm UTC](https://discuss.elastic.co/t/getting-next-10k-documents-with-appsearch-list-documents/345216 "2023-10-17T17:14:32Z")
Hi, I'm trying to get IDs for all our 300k+ documents. The AppSearch API has list\_documents which only lists 10k documents. Is there an argument I can use with it to get the next 10k documents? I have searched and fo… --- ## [Badly formatted index, after interpolation still contains placeholder](https://discuss.elastic.co/t/badly-formatted-index-after-interpolation-still-contains-placeholder/345205)
**Author:** [@John\_paul](https://discuss.elastic.co/u/John_paul)\ **Replies:** 14\ **Last updated:** [October 17, 2023, 5:01pm UTC](https://discuss.elastic.co/t/badly-formatted-index-after-interpolation-still-contains-placeholder/345205 "2023-10-17T17:01:21Z")
Hey guys, facing this below issue, was working fine while using indexes directly but started failing when configured to use data streams, ERROR: elasticsearch - Badly formatted index, after interpolation still contains … --- ## [Could not find similarity in KnnQuery in Java Client?](https://discuss.elastic.co/t/could-not-find-similarity-in-knnquery-in-java-client/343002)
**Author:** [@csplrj](https://discuss.elastic.co/u/csplrj)\ **Replies:** 3\ **Last updated:** [October 17, 2023, 4:59pm UTC](https://discuss.elastic.co/t/could-not-find-similarity-in-knnquery-in-java-client/343002 "2023-10-17T16:59:35Z")
Could not find similarity in KnnQuery in Java Client? --- ## [Logstash jdbc plugin with MSSQL](https://discuss.elastic.co/t/logstash-jdbc-plugin-with-mssql/344912)
**Author:** [@catalin.bulancea](https://discuss.elastic.co/u/catalin.bulancea)\ **Replies:** 11\ **Last updated:** [October 17, 2023, 3:58pm UTC](https://discuss.elastic.co/t/logstash-jdbc-plugin-with-mssql/344912 "2023-10-17T15:58:05Z")
Hi Logstash gurus, I am trying to fetch data from MSSQL using the Logstash jdbc plugin. I am on logstash 7.17.4. I am using the below config for the input: input { jdbc { jdbc\_connection\_string =\> "jdbc:sqlserve… --- ## [Metric background change based on last week value](https://discuss.elastic.co/t/metric-background-change-based-on-last-week-value/345082)
**Author:** [@gnorillo](https://discuss.elastic.co/u/gnorillo)\ **Replies:** 3\ **Last updated:** [October 17, 2023, 2:24pm UTC](https://discuss.elastic.co/t/metric-background-change-based-on-last-week-value/345082 "2023-10-17T14:24:29Z")
Hi everyone, i would add a metric visualization to my dashboard with background colors based on a another metric (for example to compare same hour last week) some example to explain: if metric last hour is \>= metric l… --- ## [Plati­num license](https://discuss.elastic.co/t/plati-num-license/345213)
**Author:** [@Manal\_A](https://discuss.elastic.co/u/Manal_A)\ **Replies:** 4\ **Last updated:** [October 17, 2023, 3:46pm UTC](https://discuss.elastic.co/t/plati-num-license/345213 "2023-10-17T15:46:15Z")
Hello , I want to know if the Plati­num license is based on the number of nodes or on capacity, and whether it applies to coordinator nodes. Thank you. --- ## [Limit number of mapping fields](https://discuss.elastic.co/t/limit-number-of-mapping-fields/345226)
**Author:** [@MathieuINTIA](https://discuss.elastic.co/u/MathieuINTIA)\ **Replies:** 0\ **Last updated:** [October 17, 2023, 2:34pm UTC](https://discuss.elastic.co/t/limit-number-of-mapping-fields/345226 "2023-10-17T14:34:24Z")
Hello everyone, I have a mapping with well defined fields and fields that I don't want to see either indexed or in the mapping. Here's my mapping definition: mappings: { dynamic: false, properties: { '@t… --- ## [Filebeat not sending logs to EKS in a Microk8s Kubernetes environment](https://discuss.elastic.co/t/filebeat-not-sending-logs-to-eks-in-a-microk8s-kubernetes-environment/345221)
**Author:** [@NashF](https://discuss.elastic.co/u/NashF)\ **Replies:** 0\ **Last updated:** [October 17, 2023, 2:20pm UTC](https://discuss.elastic.co/t/filebeat-not-sending-logs-to-eks-in-a-microk8s-kubernetes-environment/345221 "2023-10-17T14:20:43Z")
I'm at my wits end with this ELK stack and Filebeat. Currently using Elasticsearch, Kibana ,Filebeat all version 8.10.2 and logstash logstash-logback-encoder:7.4 for converting my springboot microservice logs into json o… --- ## [Query to check field is exist or not](https://discuss.elastic.co/t/query-to-check-field-is-exist-or-not/345206)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 1\ **Last updated:** [October 17, 2023, 1:03pm UTC](https://discuss.elastic.co/t/query-to-check-field-is-exist-or-not/345206 "2023-10-17T13:03:37Z")
Is there any query we can run to check a fieldname is exist or not --- ## [Stopping/uninstalling Winlogbeat 8.8.2 fails](https://discuss.elastic.co/t/stopping-uninstalling-winlogbeat-8-8-2-fails/345209)
**Author:** [@ben-sec](https://discuss.elastic.co/u/ben-sec)\ **Replies:** 1\ **Last updated:** [October 17, 2023, 1:00pm UTC](https://discuss.elastic.co/t/stopping-uninstalling-winlogbeat-8-8-2-fails/345209 "2023-10-17T13:00:29Z")
Hello! I have problems with Winlogbeat 8.8.2 on 5% of my clients (service is running but I don't get any logs) and want to get rid of it, but I'm unable to stop the service and to uninstall Winlogbeat. Is there any kind… --- ## [ElasticSearch User Profile/Personalization](https://discuss.elastic.co/t/elasticsearch-user-profile-personalization/345127)
**Author:** [@RodAndTom](https://discuss.elastic.co/u/RodAndTom)\ **Replies:** 1\ **Last updated:** [October 17, 2023, 12:58pm UTC](https://discuss.elastic.co/t/elasticsearch-user-profile-personalization/345127 "2023-10-17T12:58:13Z")
Hi, I work with IDOL (Intelligent Data Operating Layer) more for more than 13 years and right now, we are evaluating which IDOL functionalities Elasticsearch can perform OOTB. One of these features is the user profile /… --- ## [ILM Setup support for ELK 8.3](https://discuss.elastic.co/t/ilm-setup-support-for-elk-8-3/345061)
**Author:** [@shailendra1](https://discuss.elastic.co/u/shailendra1)\ **Replies:** 1\ **Last updated:** [October 17, 2023, 12:53pm UTC](https://discuss.elastic.co/t/ilm-setup-support-for-elk-8-3/345061 "2023-10-17T12:53:09Z")
Dear All, i am looking some suggestions for setting up the ILM for my data/streaming/beats . i have below senerios to accomplished and keep running my platforms. Everyday the indices are generating with abc.yyy.mm.dd … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=395) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=397)