# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=869 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 870 --- ## [Problem with ".transform-internal" and ".kibana\_task\_manager\_" index](https://discuss.elastic.co/t/problem-with-transform-internal-and-kibana-task-manager-index/309393)
**Author:** [@Carlos\_Trivino](https://discuss.elastic.co/u/Carlos_Trivino)\ **Replies:** 0\ **Last updated:** [July 12, 2022, 9:28am UTC](https://discuss.elastic.co/t/problem-with-transform-internal-and-kibana-task-manager-index/309393 "2022-07-12T09:28:37Z")
hello, I have a problem with ".transform-internal" and ".kibana\_task\_manager\_" indexes, they are corrupt when I check the status (/\_cluster/allocation/explain) both show: "current\_state": "unassigned", "unassi… --- ## [Update security certificate with a different CA](https://discuss.elastic.co/t/update-security-certificate-with-a-different-ca/309288)
**Author:** [@rajvel](https://discuss.elastic.co/u/rajvel)\ **Replies:** 1\ **Last updated:** [July 12, 2022, 9:27am UTC](https://discuss.elastic.co/t/update-security-certificate-with-a-different-ca/309288 "2022-07-12T09:27:47Z")
Hello Team, As per the document , first we need to take a backup of elaticsearch.yml, the elasticsearch.yml file in the current 8 version looks different. Enable security features xpack.security.enabled: true xpack.… --- ## [Adding new node to existing cluster, not being recognized](https://discuss.elastic.co/t/adding-new-node-to-existing-cluster-not-being-recognized/309327)
**Author:** [@Rowan05](https://discuss.elastic.co/u/Rowan05)\ **Replies:** 10\ **Last updated:** [July 12, 2022, 9:21am UTC](https://discuss.elastic.co/t/adding-new-node-to-existing-cluster-not-being-recognized/309327 "2022-07-12T09:21:57Z")
Hello, I have a server which is running ElasticSearch 7.2 on an Ubuntu virtual machine. This server has limited disk space, so i want to add disk space. I was thinking of two options. Add an hard drive to server and… --- ## [ILM helm, indexes are bigger the 50g](https://discuss.elastic.co/t/ilm-helm-indexes-are-bigger-the-50g/309390)
**Author:** [@alon\_carmelly](https://discuss.elastic.co/u/alon_carmelly)\ **Replies:** 1\ **Last updated:** [July 12, 2022, 9:15am UTC](https://discuss.elastic.co/t/ilm-helm-indexes-are-bigger-the-50g/309390 "2022-07-12T09:15:46Z")
I thought I set the ILM correctly but indexs keep getting bigger then 50g this is the policy I have, what am I doing wrong ? PUT \_ilm/policy/30-days-default\_alonzon { "policy": { "phases": { "hot": { … --- ## [Logs didn't show in kibana, but there is no relevant error in logs](https://discuss.elastic.co/t/logs-didnt-show-in-kibana-but-there-is-no-relevant-error-in-logs/309385)
**Author:** [@Baguette](https://discuss.elastic.co/u/Baguette)\ **Replies:** 1\ **Last updated:** [July 12, 2022, 8:46am UTC](https://discuss.elastic.co/t/logs-didnt-show-in-kibana-but-there-is-no-relevant-error-in-logs/309385 "2022-07-12T08:46:18Z")
Hello, I have troubles with my ELK stack for the past few weeks; in fact, logs stop showing in kibana, but i don't have any error on the logs. My stack is composed of logstash - elasticsearch and kibana installed on a … --- ## [Error: Cannot read properties of undefined (reading 'includes')](https://discuss.elastic.co/t/error-cannot-read-properties-of-undefined-reading-includes/303696)
**Author:** [@Amitesh\_Gupta](https://discuss.elastic.co/u/Amitesh_Gupta)\ **Replies:** 10\ **Last updated:** [July 12, 2022, 8:29am UTC](https://discuss.elastic.co/t/error-cannot-read-properties-of-undefined-reading-includes/303696 "2022-07-12T08:29:43Z")
When I am trying to access security from kibana dashboard I'm getting this error. Error Error: Cannot read properties of undefined (reading 'includes') at c (http://10.9.1.8:5601/50723/bundles/plugin/securitySoluti… --- ## [Boost score for prefix matches](https://discuss.elastic.co/t/boost-score-for-prefix-matches/309384)
**Author:** [@bogdanjsx](https://discuss.elastic.co/u/bogdanjsx)\ **Replies:** 0\ **Last updated:** [July 12, 2022, 7:43am UTC](https://discuss.elastic.co/t/boost-score-for-prefix-matches/309384 "2022-07-12T07:43:18Z")
Hello! I'm trying to implement something similar to a store search for products and I'm having a hard time boosting result score to order them in a specific manner. Let's say I have a name field in my documents and I w… --- ## [Sudo ./logstash --path.settings /etc/logstash command is throwing error](https://discuss.elastic.co/t/sudo-logstash-path-settings-etc-logstash-command-is-throwing-error/309381)
**Author:** [@pooja5](https://discuss.elastic.co/u/pooja5)\ **Replies:** 0\ **Last updated:** [July 12, 2022, 7:14am UTC](https://discuss.elastic.co/t/sudo-logstash-path-settings-etc-logstash-command-is-throwing-error/309381 "2022-07-12T07:14:32Z")
Hello! We are trying to trigger multiple pipelines from pipelines.yml using the command sudo ./logstash --path.settings /etc/logstash However, we are facing the below errors \[ERROR\]\[logstash.agent \] Fail… --- ## [How to install plugins without restarting the cluster](https://discuss.elastic.co/t/how-to-install-plugins-without-restarting-the-cluster/309367)
**Author:** [@eom3835](https://discuss.elastic.co/u/eom3835)\ **Replies:** 1\ **Last updated:** [July 12, 2022, 5:58am UTC](https://discuss.elastic.co/t/how-to-install-plugins-without-restarting-the-cluster/309367 "2022-07-12T05:58:23Z")
I am using the modified plugin. I always have to restart to apply my modified plugin to ES. I can't stop nodes that are currently live, so I have to increase the server and copy the data. And I need to reinstall the p… --- ## [How do I do Case Sensitive Match Query in Elastic Search?](https://discuss.elastic.co/t/how-do-i-do-case-sensitive-match-query-in-elastic-search/309348)
**Author:** [@DataStorageMuse](https://discuss.elastic.co/u/DataStorageMuse)\ **Replies:** 5\ **Last updated:** [July 12, 2022, 5:53am UTC](https://discuss.elastic.co/t/how-do-i-do-case-sensitive-match-query-in-elastic-search/309348 "2022-07-12T05:53:47Z")
I'm trying to do a match query that is case sensitive such that it only returns words where the html field contains the string. Here is the query I have so far: POST data/\_search { "track\_total\_hits": true, "query"… --- ## [Copy\_to vs appending all terms in a string : Are the search results going to be the same?](https://discuss.elastic.co/t/copy-to-vs-appending-all-terms-in-a-string-are-the-search-results-going-to-be-the-same/308385)
**Author:** [@ano](https://discuss.elastic.co/u/ano)\ **Replies:** 2\ **Last updated:** [July 12, 2022, 3:09am UTC](https://discuss.elastic.co/t/copy-to-vs-appending-all-terms-in-a-string-are-the-search-results-going-to-be-the-same/308385 "2022-07-12T03:09:14Z")
Hi, I'm building an e-commerce search engine, and I want to do a full text search on product name, category, and a few other fields. I'm currently using copy\_to to copy all the individual fields into 1 single field (cal… --- ## [Timestamp for global target](https://discuss.elastic.co/t/timestamp-for-global-target/309358)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 1\ **Last updated:** [July 12, 2022, 1:34am UTC](https://discuss.elastic.co/t/timestamp-for-global-target/309358 "2022-07-12T01:34:01Z")
Hi I'm facing with case that I couldn't brake the setting for timestamp for the rest of messages here my input: input { generator { lines =\> \[ "# snapshot,66472243,20220704061503", "list… --- ## [How to use logstash imap plugin to acquire data from multiple user account?](https://discuss.elastic.co/t/how-to-use-logstash-imap-plugin-to-acquire-data-from-multiple-user-account/309300)
**Author:** [@Ayush\_Gupta](https://discuss.elastic.co/u/Ayush_Gupta)\ **Replies:** 0\ **Last updated:** [July 11, 2022, 8:47am UTC](https://discuss.elastic.co/t/how-to-use-logstash-imap-plugin-to-acquire-data-from-multiple-user-account/309300 "2022-07-11T08:47:07Z")
Hi, I am new to Elasticsearch and logstash. I am able to extract data from one user account.Now I want to extract data from multiple user accounts, plz help over this. --- ## [Recorded Future v1.0.1 Not Populating Intel Properly](https://discuss.elastic.co/t/recorded-future-v1-0-1-not-populating-intel-properly/309231)
**Author:** [@codewriterguy](https://discuss.elastic.co/u/codewriterguy)\ **Replies:** 1\ **Last updated:** [July 11, 2022, 9:21pm UTC](https://discuss.elastic.co/t/recorded-future-v1-0-1-not-populating-intel-properly/309231 "2022-07-11T21:21:42Z")
Hi, The Recorded Future integration package v1.0.1 appears not to be properly pulling risklists from Recorded Future. Intel is streaming into the instance (screenshot at 22:15UTC): Elastic agent is healthy: I'v… --- ## [Permission denied error when starting Elasticsearch as Singularity container](https://discuss.elastic.co/t/permission-denied-error-when-starting-elasticsearch-as-singularity-container/309228)
**Author:** [@lucasl](https://discuss.elastic.co/u/lucasl)\ **Replies:** 1\ **Last updated:** [July 11, 2022, 8:10pm UTC](https://discuss.elastic.co/t/permission-denied-error-when-starting-elasticsearch-as-singularity-container/309228 "2022-07-11T20:10:13Z")
Hello, I am trying to run single node Elasticsearch instance on a HPC cluster. To do this, I am converting the Elasticsearch docker container as a singularity container. When I launch the container itself I get the foll… --- ## [Watcher.go logs old docker container events as if they are new and may log error if container has been removed](https://discuss.elastic.co/t/watcher-go-logs-old-docker-container-events-as-if-they-are-new-and-may-log-error-if-container-has-been-removed/309355)
**Author:** [@chad.showalter](https://discuss.elastic.co/u/chad.showalter)\ **Replies:** 0\ **Last updated:** [July 11, 2022, 7:09pm UTC](https://discuss.elastic.co/t/watcher-go-logs-old-docker-container-events-as-if-they-are-new-and-may-log-error-if-container-has-been-removed/309355 "2022-07-11T19:09:50Z")
We are using filebeat to publish our application logs to graylog. Both our application and filebeat are running in docker containers. When we turn on debug logging in filebeat, we observe that a debug logging statement… --- ## [Index template pattern error](https://discuss.elastic.co/t/index-template-pattern-error/309351)
**Author:** [@Thuunder7](https://discuss.elastic.co/u/Thuunder7)\ **Replies:** 0\ **Last updated:** [July 11, 2022, 5:58pm UTC](https://discuss.elastic.co/t/index-template-pattern-error/309351 "2022-07-11T17:58:36Z")
Hi guys, I am trying to create a new index template but for some reason elasticsearch is assuming that there is already one index template with the index pattern requested... { "error" : { "root\_cause" : \[ … --- ## [Get my systems with Filebeat on them to communicate with my logstash system using Certs](https://discuss.elastic.co/t/get-my-systems-with-filebeat-on-them-to-communicate-with-my-logstash-system-using-certs/309341)
**Author:** [@timfox123](https://discuss.elastic.co/u/timfox123)\ **Replies:** 0\ **Last updated:** [July 11, 2022, 3:55pm UTC](https://discuss.elastic.co/t/get-my-systems-with-filebeat-on-them-to-communicate-with-my-logstash-system-using-certs/309341 "2022-07-11T15:55:11Z")
Objective: To get my systems with Filebeat on them to communicate with my logstash system using Certs. License: Free Environment Elasticsearch nodes: We have 3 ES 7.17 Linux nodes that are working together just f… --- ## [Update\_by\_query with proceed does not return failure](https://discuss.elastic.co/t/update-by-query-with-proceed-does-not-return-failure/309338)
**Author:** [@Paul\_Le\_Tilly](https://discuss.elastic.co/u/Paul_Le_Tilly)\ **Replies:** 0\ **Last updated:** [July 11, 2022, 3:48pm UTC](https://discuss.elastic.co/t/update-by-query-with-proceed-does-not-return-failure/309338 "2022-07-11T15:48:19Z")
HI all, So I was reading a bit about the documentation for the api update\_by\_query. From my understanding of the conflict, parameter. You can have 2 behaviours Abort, that will stop at the first issue and report on… --- ## [Logstash not running in Remote Windows Continuously](https://discuss.elastic.co/t/logstash-not-running-in-remote-windows-continuously/309005)
**Author:** [@suresh\_u](https://discuss.elastic.co/u/suresh_u)\ **Replies:** 8\ **Last updated:** [July 11, 2022, 3:33pm UTC](https://discuss.elastic.co/t/logstash-not-running-in-remote-windows-continuously/309005 "2022-07-11T15:33:17Z")
I am using Logstash-7.17.4 version to index data from oracle db to Elasticsearch. When I am running through Command Prompt, it is running but when running through Task Scheduler, logstash has stopped automatically after… --- ## [Logstash Issue - export kafka messages into tsv format](https://discuss.elastic.co/t/logstash-issue-export-kafka-messages-into-tsv-format/309321)
**Author:** [@aniketdatir](https://discuss.elastic.co/u/aniketdatir)\ **Replies:** 1\ **Last updated:** [July 11, 2022, 3:22pm UTC](https://discuss.elastic.co/t/logstash-issue-export-kafka-messages-into-tsv-format/309321 "2022-07-11T15:22:23Z")
Hi Elastic team, I am trying to export Kafka messages into tab separated file (tsv) file using below logstash configuration file......But not able to get desired output. input { kafka { bootstrap\_servers =\> "host:por… --- ## [Logging configuration Kibana](https://discuss.elastic.co/t/logging-configuration-kibana/308580)
**Author:** [@Lily\_si](https://discuss.elastic.co/u/Lily_si)\ **Replies:** 3\ **Last updated:** [July 11, 2022, 1:40pm UTC](https://discuss.elastic.co/t/logging-configuration-kibana/308580 "2022-07-11T13:40:21Z")
Hello Everyone, I'm trying to set logging parameters in the file kibana.yml by using the "rolling-file" function, here is my configuration : logging: appenders: rolling-file: type: rolling-file fileNa… --- ## [Http\_poller logstash input plugin : socks5](https://discuss.elastic.co/t/http-poller-logstash-input-plugin-socks5/309333)
**Author:** [@toog](https://discuss.elastic.co/u/toog)\ **Replies:** 0\ **Last updated:** [July 11, 2022, 3:16pm UTC](https://discuss.elastic.co/t/http-poller-logstash-input-plugin-socks5/309333 "2022-07-11T15:16:14Z")
I try to use http\_poller to request url but i need to use a dynamic ssh forwarding. How i can specify to http\_poller to use the socks5 proxy to resolve the url request ? i try this config but i have this message http\_… --- ## [Logstash Auto Reconnect Stomp](https://discuss.elastic.co/t/logstash-auto-reconnect-stomp/309332)
**Author:** [@tahseenjamal](https://discuss.elastic.co/u/tahseenjamal)\ **Replies:** 0\ **Last updated:** [July 11, 2022, 2:59pm UTC](https://discuss.elastic.co/t/logstash-auto-reconnect-stomp/309332 "2022-07-11T14:59:37Z")
Am using stomp input plugin to fetch data from ActiveMQ I tested a scenario, where I stopped and then started ActiveMQ. This caused logstash to stop fetching data from ActiveMQ. This means logstash is not auto reconnect… --- ## [Access inner\_hits response in Apache Hadoop Spark](https://discuss.elastic.co/t/access-inner-hits-response-in-apache-hadoop-spark/309320)
**Author:** [@anand\_tripathi](https://discuss.elastic.co/u/anand_tripathi)\ **Replies:** 1\ **Last updated:** [July 11, 2022, 1:42pm UTC](https://discuss.elastic.co/t/access-inner-hits-response-in-apache-hadoop-spark/309320 "2022-07-11T13:42:24Z")
I have an Elasticsearch query that is giving me a response with standard \_source data and some additional response that is inner\_hits matching the nested document of the index. The response is something like below { "… --- ## [Unable to set trackTotalHits to true in Java RestHighLevelClient](https://discuss.elastic.co/t/unable-to-set-tracktotalhits-to-true-in-java-resthighlevelclient/309284)
**Author:** [@shashi-bhushan](https://discuss.elastic.co/u/shashi-bhushan)\ **Replies:** 1\ **Last updated:** [July 11, 2022, 1:25pm UTC](https://discuss.elastic.co/t/unable-to-set-tracktotalhits-to-true-in-java-resthighlevelclient/309284 "2022-07-11T13:25:45Z")
Hi, I'm unable to make use of track\_total\_hits flag when using Java RestHighLevelClient. I was checking Elastic code a bit and it looks like the RequestConverters#addSearchRequestParams method is adding only certain par… --- ## [Question About Removing A Node From A Production ELK Stack](https://discuss.elastic.co/t/question-about-removing-a-node-from-a-production-elk-stack/308589)
**Author:** [@NJMitchell](https://discuss.elastic.co/u/NJMitchell)\ **Replies:** 2\ **Last updated:** [July 11, 2022, 1:23pm UTC](https://discuss.elastic.co/t/question-about-removing-a-node-from-a-production-elk-stack/308589 "2022-07-11T13:23:30Z")
Hello, I have a question about removing a node from a production ELK Stack. We are removing a server from the stack to repurpose it for another use. After moving shards from the node that we are targeting for removal fr… --- ## [Node left the cluster caused few Primary unassigned left](https://discuss.elastic.co/t/node-left-the-cluster-caused-few-primary-unassigned-left/309312)
**Author:** [@aman123](https://discuss.elastic.co/u/aman123)\ **Replies:** 3\ **Last updated:** [July 11, 2022, 12:52pm UTC](https://discuss.elastic.co/t/node-left-the-cluster-caused-few-primary-unassigned-left/309312 "2022-07-11T12:52:26Z")
Node suddenly left the cluster because of issue, some of the primary shards left unassigned, because of below issue : slight\_smile: can\_allocate" : "no\_valid\_shard\_copy", "allocate\_explanation" : "cannot allocate becau… --- ## [Transform for predefined fields](https://discuss.elastic.co/t/transform-for-predefined-fields/309261)
**Author:** [@Robina\_Dhingra1](https://discuss.elastic.co/u/Robina_Dhingra1)\ **Replies:** 8\ **Last updated:** [July 11, 2022, 11:27am UTC](https://discuss.elastic.co/t/transform-for-predefined-fields/309261 "2022-07-11T11:27:22Z")
Hi Team elastic, We have a use case, where we created a continuous pivot transform on a source index to get count of status of transactions. If status of any of the transaction changes, the same document appears in dest… --- ## [Logstach configuration](https://discuss.elastic.co/t/logstach-configuration/309306)
**Author:** [@escanor\_sama](https://discuss.elastic.co/u/escanor_sama)\ **Replies:** 1\ **Last updated:** [July 11, 2022, 11:19am UTC](https://discuss.elastic.co/t/logstach-configuration/309306 "2022-07-11T11:19:14Z")
Hello, Hope everyone is doing well I installed ELK on a Debian recently and I want Logstash to receive logs from another machine (windows) that is in the same network. Can I achieve that without using Filebeat? Can I … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=868) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=870)