# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=746 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 747 --- ## [Failed to fetch X-pack information from ES - Failure to reach live ES Cluster](https://discuss.elastic.co/t/failed-to-fetch-x-pack-information-from-es-failure-to-reach-live-es-cluster/317306)
**Author:** [@jakinmayowa](https://discuss.elastic.co/u/jakinmayowa)\ **Replies:** 2\ **Last updated:** [November 2, 2022, 10:49am UTC](https://discuss.elastic.co/t/failed-to-fetch-x-pack-information-from-es-failure-to-reach-live-es-cluster/317306 "2022-11-02T10:49:12Z")
I'm currently configuring Logstash ArcSight Module, however I've reached a road-block, error message below: Sending Logstash logs to /usr/share/logstash/logs which is now configured via log4j2.properties \[2022-10-24T10:… --- ## [Aggregation of fields](https://discuss.elastic.co/t/aggregation-of-fields/317969)
**Author:** [@arphillips](https://discuss.elastic.co/u/arphillips)\ **Replies:** 0\ **Last updated:** [November 2, 2022, 10:48am UTC](https://discuss.elastic.co/t/aggregation-of-fields/317969 "2022-11-02T10:48:39Z")
How do I aggregate fields with vega in a sankey graph? I want to build a graph that shows AS paths using bytes. I have most of the graph in place. However, when I use bytes I get a 'flow' for each different number, can … --- ## [Filebeat high read io when collecting log data](https://discuss.elastic.co/t/filebeat-high-read-io-when-collecting-log-data/317857)
**Author:** [@Zhi\_Li](https://discuss.elastic.co/u/Zhi_Li)\ **Replies:** 2\ **Last updated:** [November 2, 2022, 9:18am UTC](https://discuss.elastic.co/t/filebeat-high-read-io-when-collecting-log-data/317857 "2022-11-02T09:18:10Z")
I have a Filebeat setup to collect log data in SATA, but it does have a high read IO of around 20mb/s. below is my Filebeat config, it outputs to Kafka cluster. im just wondering is there any way to slow down the Filebea… --- ## [Logstash profile](https://discuss.elastic.co/t/logstash-profile/317934)
**Author:** [@GEHsu](https://discuss.elastic.co/u/GEHsu)\ **Replies:** 1\ **Last updated:** [November 2, 2022, 8:59am UTC](https://discuss.elastic.co/t/logstash-profile/317934 "2022-11-02T08:59:46Z")
System is Ubuntu Logstash version 7.17 The current idea is to collect logs (via syslog-514Port) from different servers or network devices Logstash will then send the log cut to Elasticsearch I have successfully recei… --- ## [Logstash stuck when lumberjack server is down](https://discuss.elastic.co/t/logstash-stuck-when-lumberjack-server-is-down/317955)
**Author:** [@ferdose\_shaik](https://discuss.elastic.co/u/ferdose_shaik)\ **Replies:** 0\ **Last updated:** [November 2, 2022, 8:44am UTC](https://discuss.elastic.co/t/logstash-stuck-when-lumberjack-server-is-down/317955 "2022-11-02T08:44:07Z")
We are using Logstash 7.15.2 with following lumberjack output configured. output { lumberjack { id =\> "dcae5gcprod" hosts =\> \["dcae-5gc-prod.ecomp.idns.cci.att.com"\] codec =\> json port =\> 31135 ssl\_cert… --- ## [Steps to configure and use memcached in logstash. Can you please share with me the steps](https://discuss.elastic.co/t/steps-to-configure-and-use-memcached-in-logstash-can-you-please-share-with-me-the-steps/317727)
**Author:** [@danishbit09](https://discuss.elastic.co/u/danishbit09)\ **Replies:** 4\ **Last updated:** [November 2, 2022, 8:32am UTC](https://discuss.elastic.co/t/steps-to-configure-and-use-memcached-in-logstash-can-you-please-share-with-me-the-steps/317727 "2022-11-02T08:32:42Z")
Can you please share with me the steps to configure and run memcached in filter plugin. Is memcached server configured in logstash internally or I have to install and start memcached externally? Please guide me. --- ## [Cluster is yellow and 3 shards are unassigned](https://discuss.elastic.co/t/cluster-is-yellow-and-3-shards-are-unassigned/317892)
**Author:** [@fribse](https://discuss.elastic.co/u/fribse)\ **Replies:** 2\ **Last updated:** [November 2, 2022, 8:32am UTC](https://discuss.elastic.co/t/cluster-is-yellow-and-3-shards-are-unassigned/317892 "2022-11-02T08:32:13Z")
I had a Elastic search stack crash due to disk almost full, after enabling extra winlogbeat, which took me a bit with surprise, so I added some policies to reduce them a bit. But after doing that and expanding the disk,… --- ## [Grok pattern](https://discuss.elastic.co/t/grok-pattern/317891)
**Author:** [@abkonred1](https://discuss.elastic.co/u/abkonred1)\ **Replies:** 4\ **Last updated:** [November 2, 2022, 7:25am UTC](https://discuss.elastic.co/t/grok-pattern/317891 "2022-11-02T07:25:06Z")
Hi Team, I need to ingest the below log file, and i required all the fields without pipe. In order to create visualization and dashboards for the same. kindly any one please help, how to split the fields with this log e… --- ## [Can we do CCR between ECE & elastic cloud services? between local and Elastic cloud services?](https://discuss.elastic.co/t/can-we-do-ccr-between-ece-elastic-cloud-services-between-local-and-elastic-cloud-services/317921)
**Author:** [@Vijaykumar\_Deshmukh1](https://discuss.elastic.co/u/Vijaykumar_Deshmukh1)\ **Replies:** 3\ **Last updated:** [November 2, 2022, 6:44am UTC](https://discuss.elastic.co/t/can-we-do-ccr-between-ece-elastic-cloud-services-between-local-and-elastic-cloud-services/317921 "2022-11-02T06:44:06Z")
Just want to know Can i do CCR between ECE and Elastic cloud services?? Can i do CCR between local machine and Elastic cloud services?? Can i do CCR between local machine and ECE?? Thanks! --- ## [Split index failed](https://discuss.elastic.co/t/split-index-failed/317744)
**Author:** [@tonycongjie](https://discuss.elastic.co/u/tonycongjie)\ **Replies:** 2\ **Last updated:** [November 2, 2022, 5:09am UTC](https://discuss.elastic.co/t/split-index-failed/317744 "2022-11-02T05:09:21Z")
Hello, I tried to split my index to more shard. My cluster has 3 node, the index currently have 1 shard and 1 replicas. I tried to split the shard, but I got a return with “shards\_acknowledged : false” PUT /my\_source\_i… --- ## [Is Elasticsearch suitable for efficient retrieval of large number of docs?](https://discuss.elastic.co/t/is-elasticsearch-suitable-for-efficient-retrieval-of-large-number-of-docs/317845)
**Author:** [@David\_Yu](https://discuss.elastic.co/u/David_Yu)\ **Replies:** 14\ **Last updated:** [November 1, 2022, 4:13pm UTC](https://discuss.elastic.co/t/is-elasticsearch-suitable-for-efficient-retrieval-of-large-number-of-docs/317845 "2022-11-01T16:13:17Z")
How do we use ES? Our team is using ES to index ads metadata. When we need to show a user ads, we query ES for a list of ads that satisfy certain criteria (e.g. geo, queries, campaign date range, etc). Upon fetching the… --- ## [HIVE-Elasticsearch Error Handler for Malformed records](https://discuss.elastic.co/t/hive-elasticsearch-error-handler-for-malformed-records/317901)
**Author:** [@Md\_rafi](https://discuss.elastic.co/u/Md_rafi)\ **Replies:** 2\ **Last updated:** [November 2, 2022, 3:31am UTC](https://discuss.elastic.co/t/hive-elasticsearch-error-handler-for-malformed-records/317901 "2022-11-02T03:31:32Z")
Hi, We are trying to ingest data from Hive to Elasticsearch, Had issues ingesting the data and few of them are malformed json records Followed below documentation for handling bad records and created DDL script to ing… --- ## [Never started node but got ERROR: Skipping security auto configuration because it appears that security is already configured](https://discuss.elastic.co/t/never-started-node-but-got-error-skipping-security-auto-configuration-because-it-appears-that-security-is-already-configured/317757)
**Author:** [@2019240081](https://discuss.elastic.co/u/2019240081)\ **Replies:** 3\ **Last updated:** [November 2, 2022, 2:44am UTC](https://discuss.elastic.co/t/never-started-node-but-got-error-skipping-security-auto-configuration-because-it-appears-that-security-is-already-configured/317757 "2022-11-02T02:44:02Z")
I got token from already running master node with following command bin\\elasticsearch-create-enrollment-token -s node I ran other node that I've never strated bin\\elasticsearch --enrollment-token \ b… --- ## [Need advice for my small ElasticSearch cluster](https://discuss.elastic.co/t/need-advice-for-my-small-elasticsearch-cluster/317881)
**Author:** [@tomboy](https://discuss.elastic.co/u/tomboy)\ **Replies:** 2\ **Last updated:** [November 1, 2022, 11:56pm UTC](https://discuss.elastic.co/t/need-advice-for-my-small-elasticsearch-cluster/317881 "2022-11-01T23:56:39Z")
Hi all, We have a 3-node cluster in production in the past, and recently we added an independent DC for backup usage. For simplicity, I want to deploy a single ES instance in the backup DC, and keep data in sync with 3… --- ## [Exiting: error connecting to Kibana: fail to get the Kibana version: HTTP GET request to http://X.X.X.X:5601/api/status fails: fail to execute the HTTP GET request: Get "http://X.X.X.X:5601/api/status": context deadline exceeded. Response:](https://discuss.elastic.co/t/exiting-error-connecting-to-kibana-fail-to-get-the-kibana-version-http-get-request-to-http-x-x-x-x-5601-api-status-fails-fail-to-execute-the-http-get-request-get-http-x-x-x-x-5601-api-status-context-deadline-exceeded-response/317848)
**Author:** [@Joao\_Malebo](https://discuss.elastic.co/u/Joao_Malebo)\ **Replies:** 22\ **Last updated:** [November 1, 2022, 11:36pm UTC](https://discuss.elastic.co/t/exiting-error-connecting-to-kibana-fail-to-get-the-kibana-version-http-get-request-to-http-x-x-x-x-5601-api-status-fails-fail-to-execute-the-http-get-request-get-http-x-x-x-x-5601-api-status-context-deadline-exceeded-response/317848 "2022-11-01T23:36:27Z")
Hello, I'm having errors loading --dashboards from filebeats to kibana. But when running the command below, it returns me the following message: \[rcmag.kta@XXXXXXXX ~\]$ sudo filebeat setup --dashboards Loading dashboar… --- ## [Is elastic agent running?](https://discuss.elastic.co/t/is-elastic-agent-running/317927)
**Author:** [@bigverm23](https://discuss.elastic.co/u/bigverm23)\ **Replies:** 0\ **Last updated:** [November 1, 2022, 11:33pm UTC](https://discuss.elastic.co/t/is-elastic-agent-running/317927 "2022-11-01T23:33:54Z")
I am trying to install fleet so after creating the policy and running the presented commands, the below is what I get. it fails. curl -L -O https://artifacts.elastic.co/downloads/beats/elastic-agent/elastic-agent-8.4.3… --- ## [Monitor indicies and shards](https://discuss.elastic.co/t/monitor-indicies-and-shards/317920)
**Author:** [@Saeedeh\_Moghimi](https://discuss.elastic.co/u/Saeedeh_Moghimi)\ **Replies:** 1\ **Last updated:** [November 1, 2022, 7:59pm UTC](https://discuss.elastic.co/t/monitor-indicies-and-shards/317920 "2022-11-01T19:59:49Z")
I'm looking for a way to monitor inside of the cluster like: how many indices are available on my cluster, how many shards each index has and ... I know we can do it manually by GET \_cluster/... commands but I'm looki… --- ## [Convert within Ingest Pipeline not outputting Target field](https://discuss.elastic.co/t/convert-within-ingest-pipeline-not-outputting-target-field/317918)
**Author:** [@Jmc](https://discuss.elastic.co/u/Jmc)\ **Replies:** 0\ **Last updated:** [November 1, 2022, 7:02pm UTC](https://discuss.elastic.co/t/convert-within-ingest-pipeline-not-outputting-target-field/317918 "2022-11-01T19:02:05Z")
I am using a Convert processor in an Ingest Pipeline, attempting to convert a field from a Keyword type to a Double type. No error is thrown when I test a document through my pipeline. However, I have opted to direct the… --- ## [Does new OpenSSL Vulnerability effect Elasticsearch/Kibana/ECE](https://discuss.elastic.co/t/does-new-openssl-vulnerability-effect-elasticsearch-kibana-ece/317768)
**Author:** [@Jugsofbeer](https://discuss.elastic.co/u/Jugsofbeer)\ **Replies:** 2\ **Last updated:** [November 1, 2022, 5:52pm UTC](https://discuss.elastic.co/t/does-new-openssl-vulnerability-effect-elasticsearch-kibana-ece/317768 "2022-11-01T17:52:28Z")
Hi, Can someone please advise if the mentioned OpenSSL vulnerabiity effects Elasticsearch/Kibana/E.C.E ? --- ## [Logstash - Adding http\_poller meta data into document](https://discuss.elastic.co/t/logstash-adding-http-poller-meta-data-into-document/317863)
**Author:** [@zx8086](https://discuss.elastic.co/u/zx8086)\ **Replies:** 2\ **Last updated:** [November 1, 2022, 4:48pm UTC](https://discuss.elastic.co/t/logstash-adding-http-poller-meta-data-into-document/317863 "2022-11-01T16:48:36Z")
The value in this field is what i require -\> http\_poller\_metadata.input.http\_poller.request.name mutate { add\_field =\> { "metric" =\> "\[http\_poller\_metadata\]\[request\]\[name\]" } } Not sure the notation when the … --- ## [Does Elasticsearch provide an equivalent of IN (SELECT...)?](https://discuss.elastic.co/t/does-elasticsearch-provide-an-equivalent-of-in-select/317910)
**Author:** [@Luis95](https://discuss.elastic.co/u/Luis95)\ **Replies:** 0\ **Last updated:** [November 1, 2022, 4:16pm UTC](https://discuss.elastic.co/t/does-elasticsearch-provide-an-equivalent-of-in-select/317910 "2022-11-01T16:16:17Z")
We are saving one item for each user, show, and episode. We save everything on the same index. The ERD would look something like this: ┌────┐ ┌────────────┐ ┌────┐ │User├─────\<┤Subscription├\>────┤Show│ └───… --- ## [How to use environment variable for logstash output elasticsearch plugin for multiple elasticsearch hosts?](https://discuss.elastic.co/t/how-to-use-environment-variable-for-logstash-output-elasticsearch-plugin-for-multiple-elasticsearch-hosts/317169)
**Author:** [@asp](https://discuss.elastic.co/u/asp)\ **Replies:** 4\ **Last updated:** [November 1, 2022, 3:07pm UTC](https://discuss.elastic.co/t/how-to-use-environment-variable-for-logstash-output-elasticsearch-plugin-for-multiple-elasticsearch-hosts/317169 "2022-11-01T15:07:54Z")
Hi, I am deploying logstash and its pipelines via ansible. I want to use the same pipeline on different installations. So I don't want to modify the elasticsearch output plugin in each pipeline. I want to use an environ… --- ## [Unable to delete old indices with life cycle policies](https://discuss.elastic.co/t/unable-to-delete-old-indices-with-life-cycle-policies/317824)
**Author:** [@harijld](https://discuss.elastic.co/u/harijld)\ **Replies:** 2\ **Last updated:** [November 1, 2022, 1:56pm UTC](https://discuss.elastic.co/t/unable-to-delete-old-indices-with-life-cycle-policies/317824 "2022-11-01T13:56:18Z")
Hi Team, Small query. I have created one life cycle policy to delete old indices from Elasticsearch. It is running fine but its not deleting old indices. I am still able to access old indices and able to see the data fr… --- ## [Index Lifecycle not being applied](https://discuss.elastic.co/t/index-lifecycle-not-being-applied/317621)
**Author:** [@OscarFilho](https://discuss.elastic.co/u/OscarFilho)\ **Replies:** 6\ **Last updated:** [November 1, 2022, 1:03pm UTC](https://discuss.elastic.co/t/index-lifecycle-not-being-applied/317621 "2022-11-01T13:03:46Z")
I'm having problems wth index lifecycle policy. As you can see in the print "ilm-index-traces-apm", there are 2 indices that are assigned to the lifecycle policy "dexco-lifecycle-7days". The "dexco-lifecycle-7days" po… --- ## [Curling ElasticSearch API using logstash keystore credentials](https://discuss.elastic.co/t/curling-elasticsearch-api-using-logstash-keystore-credentials/317647)
**Author:** [@Broken08](https://discuss.elastic.co/u/Broken08)\ **Replies:** 2\ **Last updated:** [November 1, 2022, 12:49pm UTC](https://discuss.elastic.co/t/curling-elasticsearch-api-using-logstash-keystore-credentials/317647 "2022-11-01T12:49:16Z")
Is it possible to call Elasticsearch API requests with the Logstash Keystore credentials that are stored (If they obviously are the right username/password/etc...). I know API/curl calls can be done utilizing Username p… --- ## [Fleet Server Not healthy](https://discuss.elastic.co/t/fleet-server-not-healthy/317877)
**Author:** [@shuuny-matrix](https://discuss.elastic.co/u/shuuny-matrix)\ **Replies:** 1\ **Last updated:** [November 1, 2022, 11:40am UTC](https://discuss.elastic.co/t/fleet-server-not-healthy/317877 "2022-11-01T11:40:22Z")
Hi, I tried to update the fleet server from 8.3.2 to 8.3.3 and now my fleet server is unhealthy. I t was working fine before that but somewhere I messed up. I reinstalled elastic agent but to no avail. I am running elast… --- ## ['\[bool\] malformed query, expected \[END\_OBJECT\] but found \[FIELD\_NAME\]'](https://discuss.elastic.co/t/bool-malformed-query-expected-end-object-but-found-field-name/317862)
**Author:** [@Shobhit\_Jain1](https://discuss.elastic.co/u/Shobhit_Jain1)\ **Replies:** 1\ **Last updated:** [November 1, 2022, 11:26am UTC](https://discuss.elastic.co/t/bool-malformed-query-expected-end-object-but-found-field-name/317862 "2022-11-01T11:26:11Z")
I am running the following query in Elasticsearch and for some reason I am getting an error: elasticsearch.exceptions.RequestError: RequestError(400, 'x\_content\_parse\_exception', '\[bool\] malformed query, expected \[END\_O… --- ## [Centralized list of values for queries filter](https://discuss.elastic.co/t/centralized-list-of-values-for-queries-filter/317595)
**Author:** [@Volodymyr\_Komarynsky](https://discuss.elastic.co/u/Volodymyr_Komarynsky)\ **Replies:** 2\ **Last updated:** [November 1, 2022, 11:11am UTC](https://discuss.elastic.co/t/centralized-list-of-values-for-queries-filter/317595 "2022-11-01T11:11:47Z")
Hello. Can Elasticsearch use a value from an external list or other index to filter queries? This is necessary to store the same filtering values for different requests and not to make changes in each request. --- ## [Elastic search as statefulset in kubernetes cluster](https://discuss.elastic.co/t/elastic-search-as-statefulset-in-kubernetes-cluster/317882)
**Author:** [@gsingh20](https://discuss.elastic.co/u/gsingh20)\ **Replies:** 0\ **Last updated:** [November 1, 2022, 10:33am UTC](https://discuss.elastic.co/t/elastic-search-as-statefulset-in-kubernetes-cluster/317882 "2022-11-01T10:33:53Z")
how can we sync the data between 2 persistent volume when Elasticsearch is deployed as statefulset in kubernetes cluster. when we are scaling up pods then new pv is created and data is not sync. How can we sync the data… --- ## [Nested document full text query with filter capability](https://discuss.elastic.co/t/nested-document-full-text-query-with-filter-capability/317843)
**Author:** [@john2022](https://discuss.elastic.co/u/john2022)\ **Replies:** 1\ **Last updated:** [November 1, 2022, 10:22am UTC](https://discuss.elastic.co/t/nested-document-full-text-query-with-filter-capability/317843 "2022-11-01T10:22:16Z")
Hi dear My index mappings and sample data as follows I need full text search on these type of documents with following criteria: country is one input of this search If I search "Alex 4455" and country is "xxx"… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=745) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=747)