# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=711 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 712 --- ## [Kibana pod stopped after restoring the index pattern](https://discuss.elastic.co/t/kibana-pod-stopped-after-restoring-the-index-pattern/320229)
**Author:** [@MahithaSarala](https://discuss.elastic.co/u/MahithaSarala)\ **Replies:** 7\ **Last updated:** [December 4, 2022, 9:18pm UTC](https://discuss.elastic.co/t/kibana-pod-stopped-after-restoring-the-index-pattern/320229 "2022-12-04T21:18:33Z")
Hi Team, We have deleted the data from index in elasticvue , we had backup so we have restored the index pattern now kibana pod not running after restoring . please find the kibana pod logs {"type":"log","@timestamp":… --- ## [Provision ILM policy for elastic agent streams](https://discuss.elastic.co/t/provision-ilm-policy-for-elastic-agent-streams/320348)
**Author:** [@PaulusTM](https://discuss.elastic.co/u/PaulusTM)\ **Replies:** 0\ **Last updated:** [December 2, 2022, 10:04am UTC](https://discuss.elastic.co/t/provision-ilm-policy-for-elastic-agent-streams/320348 "2022-12-02T10:04:58Z")
Hi folks, I'm new to Elastic Agent configuration and running the latest ECK build on Kubernetes. While I really like to visibility Fleet offers, it seems I'm unable to provision custom ILM policies like I can with Beat… --- ## [Node is disconnected from cluster and does not join existing cluster (ES 7.16.2)](https://discuss.elastic.co/t/node-is-disconnected-from-cluster-and-does-not-join-existing-cluster-es-7-16-2/320357)
**Author:** [@Pooja2](https://discuss.elastic.co/u/Pooja2)\ **Replies:** 1\ **Last updated:** [December 4, 2022, 9:15pm UTC](https://discuss.elastic.co/t/node-is-disconnected-from-cluster-and-does-not-join-existing-cluster-es-7-16-2/320357 "2022-12-04T21:15:10Z")
Hi Team, We have an elasticsearch(ES 7.16.2) cluster of 3 nodes in which one node(node-3) is randomly disconnected from the cluster. Node info: node-1 = master, data (currently master) node-2 = master, data node-3 =… --- ## [How to properly monitor containerized databases?](https://discuss.elastic.co/t/how-to-properly-monitor-containerized-databases/320401)
**Author:** [@jerrac](https://discuss.elastic.co/u/jerrac)\ **Replies:** 0\ **Last updated:** [December 3, 2022, 12:50am UTC](https://discuss.elastic.co/t/how-to-properly-monitor-containerized-databases/320401 "2022-12-03T00:50:21Z")
I'm in the the middle of testing how well deploying a MariaDB Galera cluster per app works in a Docker Swarm stack. The idea being that we can tweak each Galera cluster to fit each individual apps needs, have them be hi… --- ## [Retrieve records and update a field at the same time](https://discuss.elastic.co/t/retrieve-records-and-update-a-field-at-the-same-time/320432)
**Author:** [@xef](https://discuss.elastic.co/u/xef)\ **Replies:** 1\ **Last updated:** [December 4, 2022, 7:12pm UTC](https://discuss.elastic.co/t/retrieve-records-and-update-a-field-at-the-same-time/320432 "2022-12-04T19:12:44Z")
We did not get a response the first time. Hopefully someone can give us some guidance this time. Is there anyway when making a query in Elasticsearch, to update a field (such as say a counter++) in each record that is s… --- ## [Modify the max bucket to report an error](https://discuss.elastic.co/t/modify-the-max-bucket-to-report-an-error/320414)
**Author:** [@Tonyhu\_T](https://discuss.elastic.co/u/Tonyhu_T)\ **Replies:** 12\ **Last updated:** [December 4, 2022, 12:51pm UTC](https://discuss.elastic.co/t/modify-the-max-bucket-to-report-an-error/320414 "2022-12-04T12:51:05Z")
I use the following command to modify max bucket: PUT \_cluster/settings { "persistent": { "search.max\_buckets": 500000 } } But received the following error message: { "error" : { "root\_cause" : \[ {… --- ## [Issues in scalling elastic search, version conflicts](https://discuss.elastic.co/t/issues-in-scalling-elastic-search-version-conflicts/320424)
**Author:** [@Manav\_Motwani](https://discuss.elastic.co/u/Manav_Motwani)\ **Replies:** 6\ **Last updated:** [December 4, 2022, 10:31am UTC](https://discuss.elastic.co/t/issues-in-scalling-elastic-search-version-conflicts/320424 "2022-12-04T10:31:15Z")
I will describe my problem as simple as possible, so we have a index which stores product details, but we have 2 primary keys one is product id (unique for every product) and other is city id (we need city id because we … --- ## [Elasticsearch best\_compression](https://discuss.elastic.co/t/elasticsearch-best-compression/320397)
**Author:** [@VamPikmin](https://discuss.elastic.co/u/VamPikmin)\ **Replies:** 4\ **Last updated:** [December 4, 2022, 3:05am UTC](https://discuss.elastic.co/t/elasticsearch-best-compression/320397 "2022-12-04T03:05:55Z")
Hello, I have a bunch of indices that I've remotely re-indexed into a single node as a sort of a backup, these won't need to be written to anymore so I'd like to make them smaller, if possible. What would be the correc… --- ## [Ruby logstash filter](https://discuss.elastic.co/t/ruby-logstash-filter/320408)
**Author:** [@tienld](https://discuss.elastic.co/u/tienld)\ **Replies:** 1\ **Last updated:** [December 3, 2022, 6:07pm UTC](https://discuss.elastic.co/t/ruby-logstash-filter/320408 "2022-12-03T18:07:25Z")
I have a message contains Unicode Escape Sequence I want convert it to UTF-8 character with my country language (VIetnamese) Input is from filebeat filestream I use logstash to parse the message: \\u0043\\u1ea3\\u006d\\u… --- ## [Monitor host machine using metricbeat system module from inside a metricbeat docker container](https://discuss.elastic.co/t/monitor-host-machine-using-metricbeat-system-module-from-inside-a-metricbeat-docker-container/320420)
**Author:** [@Anagha\_nambiar](https://discuss.elastic.co/u/Anagha_nambiar)\ **Replies:** 2\ **Last updated:** [December 4, 2022, 12:32am UTC](https://discuss.elastic.co/t/monitor-host-machine-using-metricbeat-system-module-from-inside-a-metricbeat-docker-container/320420 "2022-12-04T00:32:12Z")
We are using metricbeat docker container version 8.1.3 to monitor Linux RHEL machines. Used docker-compose file to spin up metricbeat container. Enabled system module to monitor system metrics. But we are not able to … --- ## [Elasticsearch:8.5.2 InitContainers chown: /usr/share/elasticsearch/data: Operation not permitted](https://discuss.elastic.co/t/elasticsearch-8-5-2-initcontainers-chown-usr-share-elasticsearch-data-operation-not-permitted/320406)
**Author:** [@khteh](https://discuss.elastic.co/u/khteh)\ **Replies:** 0\ **Last updated:** [December 3, 2022, 8:19am UTC](https://discuss.elastic.co/t/elasticsearch-8-5-2-initcontainers-chown-usr-share-elasticsearch-data-operation-not-permitted/320406 "2022-12-03T08:19:54Z")
I am on AWS EKS 1.24 using EFS PVC. initContainers: - name: fix-volume-mount-permission image: busybox command: \["sh", "-c", "chown -R 1000:0 /usr/share/elasticsearch/data"\] v… --- ## [ElasticSearch 8: is there a "conf.d" folder to change settings without editing elasticsearch.yml?](https://discuss.elastic.co/t/elasticsearch-8-is-there-a-conf-d-folder-to-change-settings-without-editing-elasticsearch-yml/320076)
**Author:** [@ZaneCEO](https://discuss.elastic.co/u/ZaneCEO)\ **Replies:** 6\ **Last updated:** [December 3, 2022, 7:15am UTC](https://discuss.elastic.co/t/elasticsearch-8-is-there-a-conf-d-folder-to-change-settings-without-editing-elasticsearch-yml/320076 "2022-12-03T07:15:10Z")
I'd like to edit a few Elasticsearch 8 settings (for example: network.host), but I don't want to edit /etc/elasticsearch/elasticsearch.yml directly. What I'd like to do is to add my settings to my own file and put it in … --- ## [Elasticsearch-spark-30 read missing field(double type) error](https://discuss.elastic.co/t/elasticsearch-spark-30-read-missing-field-double-type-error/320112)
**Author:** [@918246180](https://discuss.elastic.co/u/918246180)\ **Replies:** 8\ **Last updated:** [December 3, 2022, 12:32am UTC](https://discuss.elastic.co/t/elasticsearch-spark-30-read-missing-field-double-type-error/320112 "2022-12-03T00:32:06Z")
hi! When I use the elasticsearch-spark-30\_2.12-7.16.1.jar to read data, I find that a field of double type is missing, which causes the exception of the Spark application. But I use elasticsearch-spark20\_ 2.11-7.6.1.… --- ## [Connect logstash to elasticsearch](https://discuss.elastic.co/t/connect-logstash-to-elasticsearch/320298)
**Author:** [@vassiliy.vins](https://discuss.elastic.co/u/vassiliy.vins)\ **Replies:** 4\ **Last updated:** [December 2, 2022, 8:57pm UTC](https://discuss.elastic.co/t/connect-logstash-to-elasticsearch/320298 "2022-12-02T20:57:41Z")
Hello! I can see in logstash logs that it is not able to connect to elasticsearch to provide data The ELK documentation says: Copy the self-signed CA certificate from the Elasticsearch config/certs directory. Save it… --- ## [Filebeat does not send data to logstash](https://discuss.elastic.co/t/filebeat-does-not-send-data-to-logstash/320292)
**Author:** [@vassiliy.vins](https://discuss.elastic.co/u/vassiliy.vins)\ **Replies:** 6\ **Last updated:** [December 2, 2022, 8:23pm UTC](https://discuss.elastic.co/t/filebeat-does-not-send-data-to-logstash/320292 "2022-12-02T20:23:53Z")
Hi! here is my filebeat config filebeat.inputs: - type: syslog id: my-filestream-id enabled: true paths: - /var/log/\*.log - /var/log/nginx/access\*.log - /var/log/messages - /bar/log/secure filebea… --- ## [Filebeats connected but no logs](https://discuss.elastic.co/t/filebeats-connected-but-no-logs/320393)
**Author:** [@ardue](https://discuss.elastic.co/u/ardue)\ **Replies:** 0\ **Last updated:** [December 2, 2022, 7:16pm UTC](https://discuss.elastic.co/t/filebeats-connected-but-no-logs/320393 "2022-12-02T19:16:46Z")
Hello, I have a problem, I can't see the logs on kibana while the filebeat connection is good: Here is the configuration of filebeat.yml: ###################### Filebeat Configuration Example #########################… --- ## [COPY - PASTE from KIBANA without "ROW" and "COLUMN" information](https://discuss.elastic.co/t/copy-paste-from-kibana-without-row-and-column-information/320048)
**Author:** [@Marian\_Ovidiu\_Pistol](https://discuss.elastic.co/u/Marian_Ovidiu_Pistol)\ **Replies:** 7\ **Last updated:** [December 2, 2022, 6:02pm UTC](https://discuss.elastic.co/t/copy-paste-from-kibana-without-row-and-column-information/320048 "2022-12-02T18:02:17Z")
Hello everybody, Has anyone encountered the following "issue" let's say? I want to copy some info from Kibana, and when I paste it in my notebook for example, it copy-pastes the info with the "row and column" also. It… --- ## [Error spawning Chromium browser!](https://discuss.elastic.co/t/error-spawning-chromium-browser/320373)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 1\ **Last updated:** [December 2, 2022, 5:33pm UTC](https://discuss.elastic.co/t/error-spawning-chromium-browser/320373 "2022-12-02T17:33:19Z")
Hi, am getting this error when I try to create pdf report on kibana Error: Error spawning Chromium browser!\\n at Observable.\_subscribe (/usr/share/kibana/x-pack/plugins/reporting/server/browsers/chromium/driver\_facto… --- ## [Kibana 6.8.23 CSV reporting is always failing](https://discuss.elastic.co/t/kibana-6-8-23-csv-reporting-is-always-failing/316626)
**Author:** [@Sarat\_Khilar](https://discuss.elastic.co/u/Sarat_Khilar)\ **Replies:** 3\ **Last updated:** [December 2, 2022, 5:26pm UTC](https://discuss.elastic.co/t/kibana-6-8-23-csv-reporting-is-always-failing/316626 "2022-12-02T17:26:09Z")
I am running two instances of Kibana. When I generate CSV report it is always failing and giving message "failed to generate report maximum 3 attempt reached". if anybody has idea please suggest what could be the reason … --- ## [Fingerprint filter questions: is fingerprint source sensitive to different data types? does it include the field name when calculating fingerprint?](https://discuss.elastic.co/t/fingerprint-filter-questions-is-fingerprint-source-sensitive-to-different-data-types-does-it-include-the-field-name-when-calculating-fingerprint/320326)
**Author:** [@mikhatanu](https://discuss.elastic.co/u/mikhatanu)\ **Replies:** 1\ **Last updated:** [December 2, 2022, 4:58pm UTC](https://discuss.elastic.co/t/fingerprint-filter-questions-is-fingerprint-source-sensitive-to-different-data-types-does-it-include-the-field-name-when-calculating-fingerprint/320326 "2022-12-02T16:58:03Z")
first question: If I use a source with 2 field value of different data type (1 string field and 1 integer field) and a source with 2 string field value but same content, will it output different fingerprint? second qu… --- ## [Fingerprint filter concatenate\_all\_fields vs concatenate\_sources](https://discuss.elastic.co/t/fingerprint-filter-concatenate-all-fields-vs-concatenate-sources/320318)
**Author:** [@mikhatanu](https://discuss.elastic.co/u/mikhatanu)\ **Replies:** 1\ **Last updated:** [December 2, 2022, 4:44pm UTC](https://discuss.elastic.co/t/fingerprint-filter-concatenate-all-fields-vs-concatenate-sources/320318 "2022-12-02T16:44:15Z")
Hello, does concatenate\_sources only concat field in the source option and concatenate\_all\_fields concat all the fields from the input, e.g.: i have a log with a,b,c,d,e fields. If i use this, fingerprint{ concaten… --- ## [I want to pin down Elasticsearch during Ubuntu 18.04 to 20.04 upgrade](https://discuss.elastic.co/t/i-want-to-pin-down-elasticsearch-during-ubuntu-18-04-to-20-04-upgrade/320383)
**Author:** [@menabulele](https://discuss.elastic.co/u/menabulele)\ **Replies:** 0\ **Last updated:** [December 2, 2022, 3:12pm UTC](https://discuss.elastic.co/t/i-want-to-pin-down-elasticsearch-during-ubuntu-18-04-to-20-04-upgrade/320383 "2022-12-02T15:12:47Z")
I'm trying to upgrade from ubuntu 18.04 to ubuntu 20.04 and I don't want my Elasticsearch version to change. We presently run on Elasticsearch 7.17.5 version and the upgrade is forcing a version change to 7.17.7 . We wa… --- ## [Do we need to avoid using Elastic Search as primary DB?](https://discuss.elastic.co/t/do-we-need-to-avoid-using-elastic-search-as-primary-db/320233)
**Author:** [@aswin1906](https://discuss.elastic.co/u/aswin1906)\ **Replies:** 5\ **Last updated:** [December 2, 2022, 2:55pm UTC](https://discuss.elastic.co/t/do-we-need-to-avoid-using-elastic-search-as-primary-db/320233 "2022-12-02T14:55:31Z")
We are using Elasticsearch as primary db which includes entire ELK, unfortunately last week we lost huge data from Elasticsearch during server restart. 1) Do we need to avoid using Elastic Search as primary DB? If Yes, … --- ## [Setting Env Variables in logstash configuration files](https://discuss.elastic.co/t/setting-env-variables-in-logstash-configuration-files/320341)
**Author:** [@PRASHANT\_MEHTA](https://discuss.elastic.co/u/PRASHANT_MEHTA)\ **Replies:** 3\ **Last updated:** [December 2, 2022, 2:52pm UTC](https://discuss.elastic.co/t/setting-env-variables-in-logstash-configuration-files/320341 "2022-12-02T14:52:17Z")
Hello All, I would like to know how can I set up Env Variable in logstash pipleline.yml to read config files from particular folder when logstash startup. Directory structure: C-\>Logstash-\>cfg-\>Different config files … --- ## [Adding fortinet FortiGate firewall as agent to fleet](https://discuss.elastic.co/t/adding-fortinet-fortigate-firewall-as-agent-to-fleet/320362)
**Author:** [@Med2](https://discuss.elastic.co/u/Med2)\ **Replies:** 4\ **Last updated:** [December 2, 2022, 2:38pm UTC](https://discuss.elastic.co/t/adding-fortinet-fortigate-firewall-as-agent-to-fleet/320362 "2022-12-02T14:38:36Z")
Hi, I've installed an elastic agent server and added to it several windows machines and linux servers using the enrollment tokens. Now that I've added the "Fortinet FortiGate Firewall Logs" integration in kibana and af… --- ## [Multiple Indice Search With Filters Applied Per Indice](https://discuss.elastic.co/t/multiple-indice-search-with-filters-applied-per-indice/320297)
**Author:** [@sbattGM](https://discuss.elastic.co/u/sbattGM)\ **Replies:** 3\ **Last updated:** [December 2, 2022, 2:34pm UTC](https://discuss.elastic.co/t/multiple-indice-search-with-filters-applied-per-indice/320297 "2022-12-02T14:34:17Z")
I want to perform a multiple indice search with a term search for all indices but I want to add filters for a particular indice. For example a term query like: http://0.0.0.0:9200/index\_a,index\_b/type1,type2,typ3/\_sear… --- ## [Winlogbeat 8.4 - Processors - Drop Event](https://discuss.elastic.co/t/winlogbeat-8-4-processors-drop-event/320160)
**Author:** [@prolle](https://discuss.elastic.co/u/prolle)\ **Replies:** 1\ **Last updated:** [December 2, 2022, 2:28pm UTC](https://discuss.elastic.co/t/winlogbeat-8-4-processors-drop-event/320160 "2022-12-02T14:28:17Z")
Hi, i'm trying to drop an event from being sent to my elastic cluster. On the Windows integration i have added a processor under the Windows Powershell channel and the Microsoft-Windows-Powershell/Operational channel. T… --- ## [Filebeat 8.5.2 Failed to start Filebeat sends log files to Logstash or directly to Elasticsearch](https://discuss.elastic.co/t/filebeat-8-5-2-failed-to-start-filebeat-sends-log-files-to-logstash-or-directly-to-elasticsearch/320268)
**Author:** [@ardue](https://discuss.elastic.co/u/ardue)\ **Replies:** 5\ **Last updated:** [December 2, 2022, 2:14pm UTC](https://discuss.elastic.co/t/filebeat-8-5-2-failed-to-start-filebeat-sends-log-files-to-logstash-or-directly-to-elasticsearch/320268 "2022-12-02T14:14:00Z")
Hello when I run filebeat I get this error: sudo service filebeat status filebeat.service - Filebeat sends log files to Logstash or directly to Elasticsearch. Loaded: loaded (/lib/systemd/system/filebeat.service; … --- ## [In Update action using java api client when i set few fields of java object and pass the other fields get updated](https://discuss.elastic.co/t/in-update-action-using-java-api-client-when-i-set-few-fields-of-java-object-and-pass-the-other-fields-get-updated/320325)
**Author:** [@Raghunandan](https://discuss.elastic.co/u/Raghunandan)\ **Replies:** 3\ **Last updated:** [December 2, 2022, 12:31pm UTC](https://discuss.elastic.co/t/in-update-action-using-java-api-client-when-i-set-few-fields-of-java-object-and-pass-the-other-fields-get-updated/320325 "2022-12-02T12:31:53Z")
In Update action using java API client when i set few fields of java object and pass the other fields get updated to null in Elasticsearch, and i am not sure how this happens as while sending the object i only set few f… --- ## [Rate document by term offset or location](https://discuss.elastic.co/t/rate-document-by-term-offset-or-location/320364)
**Author:** [@Ostr1969](https://discuss.elastic.co/u/Ostr1969)\ **Replies:** 0\ **Last updated:** [December 2, 2022, 11:45am UTC](https://discuss.elastic.co/t/rate-document-by-term-offset-or-location/320364 "2022-12-02T11:45:32Z")
I know that text search can show the location or offset of a term found. can I build a function that can rate or boost the doc by the offset location? for example if searching fox: "brown fox jumping over yellow fenc… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=710) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=712)