# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=704 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 705 --- ## [Where is Logstash installed by default?](https://discuss.elastic.co/t/where-is-logstash-installed-by-default/320913)
**Author:** [@timer5764](https://discuss.elastic.co/u/timer5764)\ **Replies:** 2\ **Last updated:** [December 9, 2022, 8:42pm UTC](https://discuss.elastic.co/t/where-is-logstash-installed-by-default/320913 "2022-12-09T20:42:47Z")
I have a CentOS machine that I recently installed Logstash on, using the following command: sudo yum install logstash The command executed successfully and Logstash was installed, as shown in the screenshot below: H… --- ## [ES Field Capabilities API does not return non-indexed/disabled fields when include\_unmapped=true](https://discuss.elastic.co/t/es-field-capabilities-api-does-not-return-non-indexed-disabled-fields-when-include-unmapped-true/320810)
**Author:** [@Alsheh](https://discuss.elastic.co/u/Alsheh)\ **Replies:** 3\ **Last updated:** [December 9, 2022, 8:07pm UTC](https://discuss.elastic.co/t/es-field-capabilities-api-does-not-return-non-indexed-disabled-fields-when-include-unmapped-true/320810 "2022-12-09T20:07:21Z")
Hi, I'm trying to list all fields in a certain index, indexed and non-indexed fields. I'm using the ES Field capabilities API: GET \/\_field\_caps?fields=\*&include\_unmapped=true. However, the API is not returni… --- ## [Metricbeat/system cpuinfo metricset tests fail on non-amd64 platforms](https://discuss.elastic.co/t/metricbeat-system-cpuinfo-metricset-tests-fail-on-non-amd64-platforms/320929)
**Author:** [@Jonathan\_Albrecht](https://discuss.elastic.co/u/Jonathan_Albrecht)\ **Replies:** 0\ **Last updated:** [December 9, 2022, 7:52pm UTC](https://discuss.elastic.co/t/metricbeat-system-cpuinfo-metricset-tests-fail-on-non-amd64-platforms/320929 "2022-12-09T19:52:37Z")
Two tests in metricbeat/module/system/test\_system.py: test\_core test\_core\_with\_cpu\_ticks fail on at least arm64 and s390x because the parser for /proc/cpuinfo only supports linux amd64 cpuinfo file format currently. I… --- ## [Aggregate logs of different grok matches](https://discuss.elastic.co/t/aggregate-logs-of-different-grok-matches/320901)
**Author:** [@stefanocog](https://discuss.elastic.co/u/stefanocog)\ **Replies:** 1\ **Last updated:** [December 9, 2022, 7:51pm UTC](https://discuss.elastic.co/t/aggregate-logs-of-different-grok-matches/320901 "2022-12-09T19:51:43Z")
Hi, I apologize in advance if the request appears incorrect I need calculate the time difference between a request and response of a REST service, this service produce two logs, one for request e and one for response an… --- ## [Elastic Deployment on minukube cluster Failing](https://discuss.elastic.co/t/elastic-deployment-on-minukube-cluster-failing/320924)
**Author:** [@akansha.agarwal1](https://discuss.elastic.co/u/akansha.agarwal1)\ **Replies:** 0\ **Last updated:** [December 9, 2022, 7:42pm UTC](https://discuss.elastic.co/t/elastic-deployment-on-minukube-cluster-failing/320924 "2022-12-09T19:42:04Z")
Hi, I am trying to deploy Elastic 8.5.2 on minukube cluster using: Helm, Statefulset & simple Elasticsearch cluster specification. But all deployments are failing with error: CrashLoopBackOff Although, deployment for… --- ## [authorizeIndexAction never gets called for custom AuthorizationEngine plugin](https://discuss.elastic.co/t/authorizeindexaction-never-gets-called-for-custom-authorizationengine-plugin/320921)
**Author:** [@adamsandor](https://discuss.elastic.co/u/adamsandor)\ **Replies:** 0\ **Last updated:** [December 9, 2022, 7:23pm UTC](https://discuss.elastic.co/t/authorizeindexaction-never-gets-called-for-custom-authorizationengine-plugin/320921 "2022-12-09T19:23:16Z")
I'm building a plugin that would execute some custom authorization logic, namely integrating the OpenPolicyAgent into the authorization flow of ES. I have implemented the org.elasticsearch.xpack.core.security.authz.Autho… --- ## [Centerlized Dashboard](https://discuss.elastic.co/t/centerlized-dashboard/316518)
**Author:** [@Milan\_Dangol](https://discuss.elastic.co/u/Milan_Dangol)\ **Replies:** 3\ **Last updated:** [October 16, 2022, 10:27pm UTC](https://discuss.elastic.co/t/centerlized-dashboard/316518 "2022-10-16T22:27:10Z")
Hello team, I have a query about the centralized dashboard. I am planning to integrate 60 VMs into my Kibana and I want to view all those individual 60 VM's graphs in a single dashboard. Thank you in advance \<3 --- ## [Enable soundex level search](https://discuss.elastic.co/t/enable-soundex-level-search/320904)
**Author:** [@ryendluri](https://discuss.elastic.co/u/ryendluri)\ **Replies:** 2\ **Last updated:** [December 9, 2022, 5:17pm UTC](https://discuss.elastic.co/t/enable-soundex-level-search/320904 "2022-12-09T17:17:32Z")
how to enable soundex search in querying data from Elastic search DB? thanks --- ## [Beat -\> Logstash -\> Elasticsearch configuration problem](https://discuss.elastic.co/t/beat-logstash-elasticsearch-configuration-problem/320801)
**Author:** [@Rysiu](https://discuss.elastic.co/u/Rysiu)\ **Replies:** 1\ **Last updated:** [December 9, 2022, 3:18pm UTC](https://discuss.elastic.co/t/beat-logstash-elasticsearch-configuration-problem/320801 "2022-12-09T15:18:40Z")
I have a problem with the data flow configuration: Beat -\> Logstash -\> Elasticsearch I initially configured everything in the flow: Beat -\> Elasticsearch of course I initially did the required setup (adding standard … --- ## [Is it possible to reimplemented ukrainian build-in analyzer as a custom analyzer (extend ukrainian\_analyzer with shingle filter)?](https://discuss.elastic.co/t/is-it-possible-to-reimplemented-ukrainian-build-in-analyzer-as-a-custom-analyzer-extend-ukrainian-analyzer-with-shingle-filter/320888)
**Author:** [@va2dim](https://discuss.elastic.co/u/va2dim)\ **Replies:** 0\ **Last updated:** [December 9, 2022, 1:46pm UTC](https://discuss.elastic.co/t/is-it-possible-to-reimplemented-ukrainian-build-in-analyzer-as-a-custom-analyzer-extend-ukrainian-analyzer-with-shingle-filter/320888 "2022-12-09T13:46:27Z")
Need to reimplemented ukrainian build-in language analyzer as a custom analyzer (extend ukrainian analyzer with shingle filter). In russian we have russian\_stemmer that could be passed to custom analyzer. In ukrainian… --- ## [Kibana Can't store an async search response larger than?](https://discuss.elastic.co/t/kibana-cant-store-an-async-search-response-larger-than/316677)
**Author:** [@Nikolas1306](https://discuss.elastic.co/u/Nikolas1306)\ **Replies:** 0\ **Last updated:** [October 15, 2022, 9:53am UTC](https://discuss.elastic.co/t/kibana-cant-store-an-async-search-response-larger-than/316677 "2022-10-15T09:53:13Z")
Can't store an async search response larger than \[10485760\] bytes. This limit can be set by changing the \[search.max\_async\_search\_response\_size\] setting. --- ## [How to create snapshot on datastream](https://discuss.elastic.co/t/how-to-create-snapshot-on-datastream/320778)
**Author:** [@meternich](https://discuss.elastic.co/u/meternich)\ **Replies:** 1\ **Last updated:** [December 9, 2022, 1:43pm UTC](https://discuss.elastic.co/t/how-to-create-snapshot-on-datastream/320778 "2022-12-09T13:43:00Z")
Hello. Until recently I was using regular indexes for data collection. Every month there was a new index and i could snapshot indices by month and send them to my repo and delete them in elastic. Now I've changed data co… --- ## [Filebeat filestream input pause when disk queue full?](https://discuss.elastic.co/t/filebeat-filestream-input-pause-when-disk-queue-full/320881)
**Author:** [@KanekaGuidos](https://discuss.elastic.co/u/KanekaGuidos)\ **Replies:** 2\ **Last updated:** [December 9, 2022, 1:37pm UTC](https://discuss.elastic.co/t/filebeat-filestream-input-pause-when-disk-queue-full/320881 "2022-12-09T13:37:57Z")
Dear, I tried searching for an answer, but didn't immediately find one. I'm using filebeat's filestream input (works great!) and setup the disk queue to a max\_size. The documentation of the internal queue states the f… --- ## [Reindex vs Split index speeds](https://discuss.elastic.co/t/reindex-vs-split-index-speeds/320779)
**Author:** [@Daithi\_O\_Conchobhair](https://discuss.elastic.co/u/Daithi_O_Conchobhair)\ **Replies:** 8\ **Last updated:** [December 9, 2022, 1:23pm UTC](https://discuss.elastic.co/t/reindex-vs-split-index-speeds/320779 "2022-12-09T13:23:46Z")
Hi there, I have a relatively large index, 1.1TB, which currently has one shard due to a misconfiguration. I would like to keep my shard size around 50GB. I have two options I guess Split the index into a new index wi… --- ## [Unexpected type mapstr.M warning](https://discuss.elastic.co/t/unexpected-type-mapstr-m-warning/320834)
**Author:** [@Alex\_Lavrov](https://discuss.elastic.co/u/Alex_Lavrov)\ **Replies:** 3\ **Last updated:** [December 9, 2022, 1:05pm UTC](https://discuss.elastic.co/t/unexpected-type-mapstr-m-warning/320834 "2022-12-09T13:05:11Z")
Hello, I'm sending JSON logs using filebeat and suddenly I started to get this error: {"log.level":"warn","@timestamp":"2022-12-08T23:33:51.575+0200","log.logger":"conditions","log.origin":{"file.name":"conditions/matc… --- ## [Percolator issue, matching queries](https://discuss.elastic.co/t/percolator-issue-matching-queries/320884)
**Author:** [@Mahesh\_Hegde](https://discuss.elastic.co/u/Mahesh_Hegde)\ **Replies:** 0\ **Last updated:** [December 9, 2022, 1:02pm UTC](https://discuss.elastic.co/t/percolator-issue-matching-queries/320884 "2022-12-09T13:02:43Z")
Hi Team, Issue module - percolator Issue Version - 8.3 & 8.4 Configuration Number of shards of percolator index - 2 Total documents indexed - 78000 approximate Index size = 30MB Details - We have about 78000 quer… --- ## [Help to convert hardcoded data values in Vega to ElasticSearch](https://discuss.elastic.co/t/help-to-convert-hardcoded-data-values-in-vega-to-elasticsearch/320694)
**Author:** [@tinrik](https://discuss.elastic.co/u/tinrik)\ **Replies:** 10\ **Last updated:** [December 9, 2022, 12:50pm UTC](https://discuss.elastic.co/t/help-to-convert-hardcoded-data-values-in-vega-to-elasticsearch/320694 "2022-12-09T12:50:38Z")
Hi! I have a Vega visualization working with harcoded data points. I have pasted the code in Kibana and works identically to the Vega editor. Now I want to replace hardcoded data points with the equivalent Elasticsearc… --- ## [How can i display string on yaxis of timelion?](https://discuss.elastic.co/t/how-can-i-display-string-on-yaxis-of-timelion/320879)
**Author:** [@Cusis\_Eel](https://discuss.elastic.co/u/Cusis_Eel)\ **Replies:** 0\ **Last updated:** [December 9, 2022, 12:06pm UTC](https://discuss.elastic.co/t/how-can-i-display-string-on-yaxis-of-timelion/320879 "2022-12-09T12:06:50Z")
i did use this code .es(index=timelion\_01, timefield=input\_date,metric='max:value').fit(carry).lines(fill=5) { "input\_date" : "2022-12-09T03:00:00.00", "value" : 2 (type is maybe long) } value is only 0 to 2 … --- ## [How to get average number of samples for time series data with DSL query?](https://discuss.elastic.co/t/how-to-get-average-number-of-samples-for-time-series-data-with-dsl-query/320841)
**Author:** [@bgyomorei\_c](https://discuss.elastic.co/u/bgyomorei_c)\ **Replies:** 2\ **Last updated:** [December 9, 2022, 11:26am UTC](https://discuss.elastic.co/t/how-to-get-average-number-of-samples-for-time-series-data-with-dsl-query/320841 "2022-12-09T11:26:28Z")
I want to get the average number of request per second(or minute) for performance testing data, but the basic aggregation possibilities i've found so far doesn't cover this. I could only do a count on a field, but that … --- ## [Logstash and elasticsearch bundled java update](https://discuss.elastic.co/t/logstash-and-elasticsearch-bundled-java-update/320853)
**Author:** [@Ravi\_Vishwakarma](https://discuss.elastic.co/u/Ravi_Vishwakarma)\ **Replies:** 2\ **Last updated:** [December 9, 2022, 11:01am UTC](https://discuss.elastic.co/t/logstash-and-elasticsearch-bundled-java-update/320853 "2022-12-09T11:01:43Z")
Hi, We are using ELK stack 7.17.2 in our environment. We have found vulnerability on Logstash and Elasticsearch for JDK. We have used jdk bundled one. Below is the VA snap. Please let me know how i can update the JDK … --- ## [Clone cluster with Logstash](https://discuss.elastic.co/t/clone-cluster-with-logstash/320551)
**Author:** [@lduvnjak](https://discuss.elastic.co/u/lduvnjak)\ **Replies:** 19\ **Last updated:** [December 9, 2022, 9:44am UTC](https://discuss.elastic.co/t/clone-cluster-with-logstash/320551 "2022-12-09T09:44:25Z")
Hey Everyone, We're trying to figure out the best way to clone a cluster completely, and Logstash seems to be the best option on a large scale as there's no need to use a custom solution. An example configuration of wh… --- ## [Kibana Query Taking too long](https://discuss.elastic.co/t/kibana-query-taking-too-long/320865)
**Author:** [@Arjun\_Meena](https://discuss.elastic.co/u/Arjun_Meena)\ **Replies:** 3\ **Last updated:** [December 9, 2022, 9:24am UTC](https://discuss.elastic.co/t/kibana-query-taking-too-long/320865 "2022-12-09T09:24:37Z")
We have a visualisation that uses the below given query to fetch the data. GET commerce-access-console-logs-\*/\_search { "aggs": { "3": { "filters": { "filters": { "LUX-SearchProducts": { … --- ## [Set Static Master Node in Elasticsearch Cluster](https://discuss.elastic.co/t/set-static-master-node-in-elasticsearch-cluster/320858)
**Author:** [@hjsroldan](https://discuss.elastic.co/u/hjsroldan)\ **Replies:** 5\ **Last updated:** [December 9, 2022, 9:22am UTC](https://discuss.elastic.co/t/set-static-master-node-in-elasticsearch-cluster/320858 "2022-12-09T09:22:08Z")
Hi, I have a 3 Node Elasticsearch. I have set the discovery.seed\_hosts: \["Node1", "Node2", "Node3"\] and cluster.initial\_master\_nodes: \["Node1"\]. What is the configuration if I want the master node " Node1" to be re-ele… --- ## [Howto to visualize/map latest state of a string value of multiple docs](https://discuss.elastic.co/t/howto-to-visualize-map-latest-state-of-a-string-value-of-multiple-docs/318735)
**Author:** [@stefws](https://discuss.elastic.co/u/stefws)\ **Replies:** 0\ **Last updated:** [November 11, 2022, 11:25am UTC](https://discuss.elastic.co/t/howto-to-visualize-map-latest-state-of-a-string-value-of-multiple-docs/318735 "2022-11-11T11:25:29Z")
Got metricbeat fetching jolokia values of the state of several instances of Jboss servers of several linux boxes. I tinkering with howto best create a visualization that'll show an overview of each expected instances sta… --- ## [Elasticsearch bootstrap check](https://discuss.elastic.co/t/elasticsearch-bootstrap-check/320812)
**Author:** [@imdroid](https://discuss.elastic.co/u/imdroid)\ **Replies:** 3\ **Last updated:** [December 9, 2022, 8:32am UTC](https://discuss.elastic.co/t/elasticsearch-bootstrap-check/320812 "2022-12-09T08:32:59Z")
I'm trying to create an elasticcluster. the nodes are setup in two seperate servers. my network and transport details are as follows: network.host: 10.198.22.161 http.port: 9200 transport.host: 10.198.22.161 transport.t… --- ## [Deleting / editing existing analyzer in elastic index](https://discuss.elastic.co/t/deleting-editing-existing-analyzer-in-elastic-index/320838)
**Author:** [@Leonid\_P](https://discuss.elastic.co/u/Leonid_P)\ **Replies:** 3\ **Last updated:** [December 9, 2022, 8:17am UTC](https://discuss.elastic.co/t/deleting-editing-existing-analyzer-in-elastic-index/320838 "2022-12-09T08:17:27Z")
Hello! Is it safe to delete or change an analyzer in an existing index? Surfing through Stackoverflow and experimenting on my own I've found ways for both operations, i.e. curl -X PUT "localhost:9200/index\_name/\_setti… --- ## [Unable to create data stream in Elastic Search 7.9](https://discuss.elastic.co/t/unable-to-create-data-stream-in-elastic-search-7-9/320829)
**Author:** [@zain](https://discuss.elastic.co/u/zain)\ **Replies:** 3\ **Last updated:** [December 9, 2022, 8:03am UTC](https://discuss.elastic.co/t/unable-to-create-data-stream-in-elastic-search-7-9/320829 "2022-12-09T08:03:16Z")
Hello, I am trying to create data streams in my Elasticsearch which is 7.9 using this guide but unable to create as I cannot see options to route to State Management \> Index Management as I can see both are different op… --- ## [Error on uploading ML model to Elasticsearch](https://discuss.elastic.co/t/error-on-uploading-ml-model-to-elasticsearch/320803)
**Author:** [@Odd\_Erik\_Gronberg](https://discuss.elastic.co/u/Odd_Erik_Gronberg)\ **Replies:** 0\ **Last updated:** [December 8, 2022, 3:18pm UTC](https://discuss.elastic.co/t/error-on-uploading-ml-model-to-elasticsearch/320803 "2022-12-08T15:18:28Z")
I am trying to upload a ML model to Elasticsearch through the Eland client but there seems to be some issues. The model I am trying to upload is listed as a Compatible third party model in the documentation here: Mode… --- ## [Multiple Logstash instances sharing code](https://discuss.elastic.co/t/multiple-logstash-instances-sharing-code/320861)
**Author:** [@Thijsvdp](https://discuss.elastic.co/u/Thijsvdp)\ **Replies:** 0\ **Last updated:** [December 9, 2022, 7:05am UTC](https://discuss.elastic.co/t/multiple-logstash-instances-sharing-code/320861 "2022-12-09T07:05:59Z")
Hi, I have four pipelines, two related to seeding data, and two related to continuously update data in elasticsearch. All pipelines share a lot of code. I am planning to run the pipelines in docker, and would like to cr… --- ## [EKS to ELK integration](https://discuss.elastic.co/t/eks-to-elk-integration/320556)
**Author:** [@yasar](https://discuss.elastic.co/u/yasar)\ **Replies:** 4\ **Last updated:** [December 9, 2022, 6:44am UTC](https://discuss.elastic.co/t/eks-to-elk-integration/320556 "2022-12-09T06:44:07Z")
Hi team, Could someone please guide us, how to integrate EKS to ELK from docker pushing logs to ELK. Thanks, Yasar Arafaath A. [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=703) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=705)