# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=807 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 808 --- ## [ElasticSearch Strange behavior](https://discuss.elastic.co/t/elasticsearch-strange-behavior/313650)
**Author:** [@lcui\_dxc](https://discuss.elastic.co/u/lcui_dxc)\ **Replies:** 1\ **Last updated:** [September 5, 2022, 9:10am UTC](https://discuss.elastic.co/t/elasticsearch-strange-behavior/313650 "2022-09-05T09:10:28Z")
Hello there: I use ELK v8.3.3, it worked fine without x-park. I activated x-pack and configured Elasticsearch by adding the following initially pack.security.enabled: true xpack.security.http.ssl.enabled: true xpack.… --- ## [Kibana Machine Learnign Internal Server Error](https://discuss.elastic.co/t/kibana-machine-learnign-internal-server-error/313514)
**Author:** [@Simone1](https://discuss.elastic.co/u/Simone1)\ **Replies:** 2\ **Last updated:** [September 5, 2022, 8:24am UTC](https://discuss.elastic.co/t/kibana-machine-learnign-internal-server-error/313514 "2022-09-05T08:24:33Z")
With the basic licence i want to learn how the Kibana ML works, i've an index with more than 2milion of documents and when i select "Search all" instead of "Sample size(per shard) 100000" i receive Error loading data i… --- ## [Stack Monitoring - Elasticsearch - Elastic](https://discuss.elastic.co/t/stack-monitoring-elasticsearch-elastic/312485)
**Author:** [@alexus](https://discuss.elastic.co/u/alexus)\ **Replies:** 14\ **Last updated:** [September 5, 2022, 7:53am UTC](https://discuss.elastic.co/t/stack-monitoring-elasticsearch-elastic/312485 "2022-09-05T07:53:25Z")
Hello World! Via Kibana -\> Stack Monitoring Any ideas what causing so many spaces in between, why the line isn't solid? Thanks in advance! --- ## [Logstash centralized pipeline](https://discuss.elastic.co/t/logstash-centralized-pipeline/313625)
**Author:** [@vpolizki](https://discuss.elastic.co/u/vpolizki)\ **Replies:** 2\ **Last updated:** [September 5, 2022, 7:32am UTC](https://discuss.elastic.co/t/logstash-centralized-pipeline/313625 "2022-09-05T07:32:44Z")
Hi, I use Logstash centralized pipeline in my new cluster. I create pipeline for filebeat with: input/filter/output and it is work excellent. Now I want to add another pipeline from different filebeat that use same po… --- ## [Reason for brief cluster status RED](https://discuss.elastic.co/t/reason-for-brief-cluster-status-red/311719)
**Author:** [@nisow95612](https://discuss.elastic.co/u/nisow95612)\ **Replies:** 1\ **Last updated:** [September 5, 2022, 7:32am UTC](https://discuss.elastic.co/t/reason-for-brief-cluster-status-red/311719 "2022-09-05T07:32:43Z")
From time to time I see Cluster health API | Elasticsearch Guide \[8.3\] | Elastic return "status": "red" for a few seconds. This never lasts long, so simply running Cluster allocation explain API | Elasticsearch Guide \[8.… --- ## [Upgrade elk started with docker-compose](https://discuss.elastic.co/t/upgrade-elk-started-with-docker-compose/313259)
**Author:** [@mammodde](https://discuss.elastic.co/u/mammodde)\ **Replies:** 4\ **Last updated:** [September 5, 2022, 6:27am UTC](https://discuss.elastic.co/t/upgrade-elk-started-with-docker-compose/313259 "2022-09-05T06:27:59Z")
Hi, here is my docker-compose.yml version: "2.2" services: setup: image: docker.elastic.co/elasticsearch/elasticsearch:${STACK\_VERSION} volumes: - certs:/usr/share/elasticsearch/config/certs user: "… --- ## [When dashbaord is rendered by value the maximize panel option for visualisation is not working](https://discuss.elastic.co/t/when-dashbaord-is-rendered-by-value-the-maximize-panel-option-for-visualisation-is-not-working/311791)
**Author:** [@sanskar-panchal-gith](https://discuss.elastic.co/u/sanskar-panchal-gith)\ **Replies:** 2\ **Last updated:** [September 5, 2022, 5:53am UTC](https://discuss.elastic.co/t/when-dashbaord-is-rendered-by-value-the-maximize-panel-option-for-visualisation-is-not-working/311791 "2022-09-05T05:53:23Z")
Hi , I am developing a kibana plugin to show a dashbaord and some other custom components. I am using function dashboard.getDashboardContainerByValueRenderer() where dashboard is of type DashboardStart. I am able to s… --- ## [Elastic Enterprise Edition License](https://discuss.elastic.co/t/elastic-enterprise-edition-license/312975)
**Author:** [@MaralErdene\_Tumursuh](https://discuss.elastic.co/u/MaralErdene_Tumursuh)\ **Replies:** 3\ **Last updated:** [September 5, 2022, 5:49am UTC](https://discuss.elastic.co/t/elastic-enterprise-edition-license/312975 "2022-09-05T05:49:48Z")
Hello Dears, I installed and used elastic enterprise search with kibana. But today when i access to kibana server it displays {"statusCode":503,"error":"Service Unavailable","message":"License is not available."}. I th… --- ## [Kibana states "No Log Data Found" on ECK](https://discuss.elastic.co/t/kibana-states-no-log-data-found-on-eck/312064)
**Author:** [@papers\_hive](https://discuss.elastic.co/u/papers_hive)\ **Replies:** 13\ **Last updated:** [September 5, 2022, 5:30am UTC](https://discuss.elastic.co/t/kibana-states-no-log-data-found-on-eck/312064 "2022-09-05T05:30:38Z")
I am running Elasticsearch (ECK) on Oracle Kubernetes Engine. The version in use is 7.14.1. The stack consists of: Elasticsearch, Kibana, Filebeat+Heartbeat+Metricbeat. Each of these services runs properly and it is pro… --- ## [Elasticsearch results doesn't highlight if a text is converted to raw datatype which is integer/double while searching](https://discuss.elastic.co/t/elasticsearch-results-doesnt-highlight-if-a-text-is-converted-to-raw-datatype-which-is-integer-double-while-searching/313632)
**Author:** [@Rathan\_K](https://discuss.elastic.co/u/Rathan_K)\ **Replies:** 0\ **Last updated:** [September 4, 2022, 8:38pm UTC](https://discuss.elastic.co/t/elasticsearch-results-doesnt-highlight-if-a-text-is-converted-to-raw-datatype-which-is-integer-double-while-searching/313632 "2022-09-04T20:38:33Z")
Currently im using ES 7.10 Creating a index and mapping PUT /rathan\_index PUT /rathan\_index/\_mappings { "properties" : { "Term\_\_kt" : { "type" : "nested", "include\_in\_root" : true, "properties" : { … --- ## [Kibana server is not redy yet but the service running](https://discuss.elastic.co/t/kibana-server-is-not-redy-yet-but-the-service-running/313402)
**Author:** [@dvir8360](https://discuss.elastic.co/u/dvir8360)\ **Replies:** 6\ **Last updated:** [September 4, 2022, 11:33pm UTC](https://discuss.elastic.co/t/kibana-server-is-not-redy-yet-but-the-service-running/313402 "2022-09-04T23:33:40Z")
Hello everyone, i have a elastic cluster and i'm trying to setup kibana but i allways get this message "kibana server is not redy yet" and i configured the kibana.yaml and the elasticsearch.yaml, the status of the servi… --- ## [Need help adjusting elastic settings](https://discuss.elastic.co/t/need-help-adjusting-elastic-settings/313630)
**Author:** [@vortex\_444](https://discuss.elastic.co/u/vortex_444)\ **Replies:** 0\ **Last updated:** [September 4, 2022, 8:10pm UTC](https://discuss.elastic.co/t/need-help-adjusting-elastic-settings/313630 "2022-09-04T20:10:41Z")
Hello everyone, at the moment everything is almost fine, but there is a problem when the required string is not found through multi\_match and due to the filter selects the wrong result. If the occurrence of the string is… --- ## [Forcing shards synchronization](https://discuss.elastic.co/t/forcing-shards-synchronization/313549)
**Author:** [@cheshirecat](https://discuss.elastic.co/u/cheshirecat)\ **Replies:** 3\ **Last updated:** [September 4, 2022, 6:54pm UTC](https://discuss.elastic.co/t/forcing-shards-synchronization/313549 "2022-09-04T18:54:02Z")
Hello There! I know that shards are synchronized automatically but is there a way to force synchronization? I'm thinking of command/setting in Kibana/bash script to do fire and do it for me. --- ## [Bringing Elasticsearch node back online after being offline for a week](https://discuss.elastic.co/t/bringing-elasticsearch-node-back-online-after-being-offline-for-a-week/312497)
**Author:** [@kossde](https://discuss.elastic.co/u/kossde)\ **Replies:** 4\ **Last updated:** [September 4, 2022, 6:28pm UTC](https://discuss.elastic.co/t/bringing-elasticsearch-node-back-online-after-being-offline-for-a-week/312497 "2022-09-04T18:28:16Z")
We have an Elasticsearch data node that has been offline for a week. If we bring this node back online, will the cluster try to create new replica shards for the old primaries stored on that node or, because the shards … --- ## [Set Processor - adding a field wrong](https://discuss.elastic.co/t/set-processor-adding-a-field-wrong/313626)
**Author:** [@Mor123460](https://discuss.elastic.co/u/Mor123460)\ **Replies:** 3\ **Last updated:** [September 4, 2022, 4:53pm UTC](https://discuss.elastic.co/t/set-processor-adding-a-field-wrong/313626 "2022-09-04T16:53:18Z")
Hey. I'm trying to get a numeric value based on a string value to monitor services. When I'm getting a "Running" value I'm useing the SET Processor to add a new field with the value of 1. And when I'm getting a "Stopp… --- ## [How to import a nginx log file(from first log, first line) with filebeat to elastic?](https://discuss.elastic.co/t/how-to-import-a-nginx-log-file-from-first-log-first-line-with-filebeat-to-elastic/313620)
**Author:** [@Siavash\_Fazli](https://discuss.elastic.co/u/Siavash_Fazli)\ **Replies:** 1\ **Last updated:** [September 4, 2022, 2:15pm UTC](https://discuss.elastic.co/t/how-to-import-a-nginx-log-file-from-first-log-first-line-with-filebeat-to-elastic/313620 "2022-09-04T14:15:49Z")
Hi guys. I configured a filebeat to import nginx log files to elastic. # Module: nginx # Docs: https://www.elastic.co/guide/en/beats/filebeat/7.16/filebeat-module-nginx.html - module: nginx # Access logs access: … --- ## [\[LOGSTASH\] - Plugin input-udp and message charset](https://discuss.elastic.co/t/logstash-plugin-input-udp-and-message-charset/313617)
**Author:** [@manunc](https://discuss.elastic.co/u/manunc)\ **Replies:** 1\ **Last updated:** [September 4, 2022, 10:47am UTC](https://discuss.elastic.co/t/logstash-plugin-input-udp-and-message-charset/313617 "2022-09-04T10:47:18Z")
Hello, I have a an issue with the message charset received from the input-udp plugin. A raw trace taken using tcpdmp command on linux show the message of the UDP packat like this: Data: 8689630446410580020000001f46e00… --- ## [Cluster stats "Disk Available"](https://discuss.elastic.co/t/cluster-stats-disk-available/313604)
**Author:** [@ylasri](https://discuss.elastic.co/u/ylasri)\ **Replies:** 5\ **Last updated:** [September 4, 2022, 10:10am UTC](https://discuss.elastic.co/t/cluster-stats-disk-available/313604 "2022-09-04T10:10:38Z")
Dear, Does any one have an idea on how /\_cluster/stats computes total disk for the whole cluster ? any specific filter behind the scene on node.roles ? Bellow is the result of cluster stats API, it show disk space less… --- ## [Rename pattern of restoring snapshot API has an unexpected behavior](https://discuss.elastic.co/t/rename-pattern-of-restoring-snapshot-api-has-an-unexpected-behavior/313512)
**Author:** [@kent010341](https://discuss.elastic.co/u/kent010341)\ **Replies:** 2\ **Last updated:** [September 4, 2022, 9:53am UTC](https://discuss.elastic.co/t/rename-pattern-of-restoring-snapshot-api-has-an-unexpected-behavior/313512 "2022-09-04T09:53:46Z")
I'm using Elasticsearch 7.17.4, running with Docker. I have a snapshot containing an index called metricbeat-7.12.0-2022.09.01, and I want it to be renamed with a prefix or a suffix. However, like the image below, its … --- ## [Kibana - Stack Monitoring - No structured logs found \[2\]](https://discuss.elastic.co/t/kibana-stack-monitoring-no-structured-logs-found-2/313490)
**Author:** [@kurdit](https://discuss.elastic.co/u/kurdit)\ **Replies:** 2\ **Last updated:** [September 4, 2022, 5:19am UTC](https://discuss.elastic.co/t/kibana-stack-monitoring-no-structured-logs-found-2/313490 "2022-09-04T05:19:50Z")
hi all! I have exactly the same problem, but none of the solutions that I found here helped me :frowning: my filebeat.yml filebeat.inputs: - type: filestream id: my-filestream-id enabled: false paths: - /va… --- ## [Managing large indices](https://discuss.elastic.co/t/managing-large-indices/313596)
**Author:** [@sssamant](https://discuss.elastic.co/u/sssamant)\ **Replies:** 5\ **Last updated:** [September 4, 2022, 3:15am UTC](https://discuss.elastic.co/t/managing-large-indices/313596 "2022-09-04T03:15:24Z")
I have question about how to manage large indices. The use case is this customer want to keep the data till 10 years for read and now the issue is this our index is keep growing and its size about 4 tb now and we are see… --- ## [No results match your search criteria](https://discuss.elastic.co/t/no-results-match-your-search-criteria/313581)
**Author:** [@kurdit](https://discuss.elastic.co/u/kurdit)\ **Replies:** 5\ **Last updated:** [September 4, 2022, 1:15am UTC](https://discuss.elastic.co/t/no-results-match-your-search-criteria/313581 "2022-09-04T01:15:45Z")
hi all! Maybe a stupid question, but I couldn't figure it out myself. inaccurate search in Kibana through the search bar in Discovery does not return anything ... if you search by fields, then the pots query works I… --- ## [Can't start elasticsearch service](https://discuss.elastic.co/t/cant-start-elasticsearch-service/313607)
**Author:** [@juancamiloll](https://discuss.elastic.co/u/juancamiloll)\ **Replies:** 8\ **Last updated:** [September 3, 2022, 11:36pm UTC](https://discuss.elastic.co/t/cant-start-elasticsearch-service/313607 "2022-09-03T23:36:43Z")
Hello, I am trying to start the elasticsearch service with the command systemctl start elasticsearch but I am getting this message Job for elasticsearch.service failed because the control process exited with error code… --- ## [License question - replace 2 nodes in a cluster of 5 using hot migration](https://discuss.elastic.co/t/license-question-replace-2-nodes-in-a-cluster-of-5-using-hot-migration/313603)
**Author:** [@qbase](https://discuss.elastic.co/u/qbase)\ **Replies:** 1\ **Last updated:** [September 3, 2022, 6:14pm UTC](https://discuss.elastic.co/t/license-question-replace-2-nodes-in-a-cluster-of-5-using-hot-migration/313603 "2022-09-03T18:14:55Z")
Hi All, We have an on-prem cluster of 5 nodes with a Platinum license. We would like to replace 2 nodes in the cluster with newer hardware. However, our license allows us to use max 5 nodes. We think of adding the new… --- ## [How to calculate and present times between logs](https://discuss.elastic.co/t/how-to-calculate-and-present-times-between-logs/313324)
**Author:** [@amir\_Bialek](https://discuss.elastic.co/u/amir_Bialek)\ **Replies:** 4\ **Last updated:** [September 3, 2022, 10:06am UTC](https://discuss.elastic.co/t/how-to-calculate-and-present-times-between-logs/313324 "2022-09-03T10:06:59Z")
Hey, new user of elk with Logstash. I am using this as a confid: input { file { path =\> "/myapp/Logs/\*.slog" start\_position =\> "beginning" sincedb\_path =\> "/dev/null" } } filter { j… --- ## [Kibaba error while bootstraping](https://discuss.elastic.co/t/kibaba-error-while-bootstraping/313598)
**Author:** [@abak\_programmer](https://discuss.elastic.co/u/abak_programmer)\ **Replies:** 0\ **Last updated:** [September 3, 2022, 9:58am UTC](https://discuss.elastic.co/t/kibaba-error-while-bootstraping/313598 "2022-09-03T09:58:31Z")
hi, i have a problem when i try to bootstrap kibana, at first i ran " yarn kbn clean " then ran "yarn kbn bootstrap" but: succ 25 bootstrap builds are cached info \[@kbn/test\] running \[kbn:bootstrap\] script ERROR \[boots… --- ## [How to recover from split log messages](https://discuss.elastic.co/t/how-to-recover-from-split-log-messages/313579)
**Author:** [@bobus](https://discuss.elastic.co/u/bobus)\ **Replies:** 3\ **Last updated:** [September 2, 2022, 10:20pm UTC](https://discuss.elastic.co/t/how-to-recover-from-split-log-messages/313579 "2022-09-02T22:20:47Z")
There appears to be a years-long-standing issue with large ( longer than 16KB) messages getting split into parts and appearing on Kibana in multiple lines. Such long messages typically include Java exception stack traces… --- ## [Filebeat/Logstash Apache Access Logs timestamp issue](https://discuss.elastic.co/t/filebeat-logstash-apache-access-logs-timestamp-issue/313278)
**Author:** [@SirStephanikus](https://discuss.elastic.co/u/SirStephanikus)\ **Replies:** 8\ **Last updated:** [September 2, 2022, 8:24pm UTC](https://discuss.elastic.co/t/filebeat-logstash-apache-access-logs-timestamp-issue/313278 "2022-09-02T20:24:38Z")
Hello everyone I'm new to the ELK world and need some help with a basic Apache HTTP filebeat -\> logstash -\> Elasticsearch \<- Kibana filter/pipeline for learning purposes. Version: 8.3.3 Problem: A dummy apache acce… --- ## [Whether CCR and reindex from remote are same?](https://discuss.elastic.co/t/whether-ccr-and-reindex-from-remote-are-same/313106)
**Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\ **Replies:** 4\ **Last updated:** [September 2, 2022, 7:08pm UTC](https://discuss.elastic.co/t/whether-ccr-and-reindex-from-remote-are-same/313106 "2022-09-02T19:08:44Z")
Whether CCR and reindex from remote are same? --- ## [CCR - 7.14 to 8.0/8.x version](https://discuss.elastic.co/t/ccr-7-14-to-8-0-8-x-version/312644)
**Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\ **Replies:** 2\ **Last updated:** [September 2, 2022, 5:45pm UTC](https://discuss.elastic.co/t/ccr-7-14-to-8-0-8-x-version/312644 "2022-09-02T17:45:52Z")
Is it possible to have a CCR to new 8.0 elasticsearch cluster from existing 7.14 version elasticsearch cluster (Remote Cluster)? or the existing 7.14 version cluster needs to be upgraded to 7.17 vesrion first? [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=806) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=808)