# Latest **URL:** https://discuss.elastic.co/latest.md?page=1785 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1786 --- ## [Elastic-Agent not providing data-stream](https://discuss.elastic.co/t/elastic-agent-not-providing-data-stream/259433)
**Author:** [@cwobuzz](https://discuss.elastic.co/u/cwobuzz)\ **Replies:** 3\ **Last updated:** [March 15, 2021, 10:33am UTC](https://discuss.elastic.co/t/elastic-agent-not-providing-data-stream/259433 "2021-03-15T10:33:25Z")
I have a docker with xpac enabled. I documented what I did here: https://github.com/cwobuzz/Setting-up-Docker-Elastic-Kibana-Running-Sysmon-And-Agent/blob/master/.README.md I have agent successfully installed. However … --- ## [Kibana discover not showing data](https://discuss.elastic.co/t/kibana-discover-not-showing-data/265918)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 9\ **Last updated:** [March 15, 2021, 10:00am UTC](https://discuss.elastic.co/t/kibana-discover-not-showing-data/265918 "2021-03-15T10:00:25Z")
i have the following indices log-pb-flow-2021.02.22-000001 log-pb-flow-2021.02.22-000002 health status index uuid pri rep docs.count docs.deleted store.size pri.store.size gre… --- ## [ECK on NVMe - how to set up PV and PVC](https://discuss.elastic.co/t/eck-on-nvme-how-to-set-up-pv-and-pvc/266625)
**Author:** [@dbernard](https://discuss.elastic.co/u/dbernard)\ **Replies:** 1\ **Last updated:** [March 15, 2021, 9:45am UTC](https://discuss.elastic.co/t/eck-on-nvme-how-to-set-up-pv-and-pvc/266625 "2021-03-15T09:45:50Z")
I am a novice with K8S but experiences with Elasticsearch. I want to run about 8 Elasticsearch pods per server and have each pod claim a NMVe volume. There will be about 6 servers. What is the best way to do this? Do… --- ## [Search Issue with Long Text keyword](https://discuss.elastic.co/t/search-issue-with-long-text-keyword/266513)
**Author:** [@sdubey472](https://discuss.elastic.co/u/sdubey472)\ **Replies:** 6\ **Last updated:** [March 15, 2021, 9:30am UTC](https://discuss.elastic.co/t/search-issue-with-long-text-keyword/266513 "2021-03-15T09:30:34Z")
I'm facing the issue with elastic Search, Actually I've search query given bellow and By using this search query I'm facing the issue with long text, whenever I type long text to search then search isn't giving proper r… --- ## [FATAL Port 5601 is already in use. Another instance of Kibana may be running!](https://discuss.elastic.co/t/fatal-port-5601-is-already-in-use-another-instance-of-kibana-may-be-running/267108)
**Author:** [@Prasanth\_V](https://discuss.elastic.co/u/Prasanth_V)\ **Replies:** 2\ **Last updated:** [March 15, 2021, 9:26am UTC](https://discuss.elastic.co/t/fatal-port-5601-is-already-in-use-another-instance-of-kibana-may-be-running/267108 "2021-03-15T09:26:20Z")
Kibana is not running...Could anyone please help on this case? --- ## [Logstash S3 input plugin prefix with full path is ignored](https://discuss.elastic.co/t/logstash-s3-input-plugin-prefix-with-full-path-is-ignored/267236)
**Author:** [@noako](https://discuss.elastic.co/u/noako)\ **Replies:** 0\ **Last updated:** [March 15, 2021, 9:17am UTC](https://discuss.elastic.co/t/logstash-s3-input-plugin-prefix-with-full-path-is-ignored/267236 "2021-03-15T09:17:48Z")
I am using logstash docker image with s3 input plugin for input, the issue I am having is: if I set the prefix to the full file path, then the file is ignored, with this log: 2021-03-14T11:43:56,233\]\[DEBUG\]\[logstash.i… --- ## [Caching query results](https://discuss.elastic.co/t/caching-query-results/267232)
**Author:** [@zegulas](https://discuss.elastic.co/u/zegulas)\ **Replies:** 0\ **Last updated:** [March 15, 2021, 9:08am UTC](https://discuss.elastic.co/t/caching-query-results/267232 "2021-03-15T09:08:21Z")
Hello, I am trying to cache the query results, by sending ?request\_cache=true also i can see that the cache size is increasing, but i don't see any improvement in response time. Basically what is happening is, when we… --- ## [Varying result size per in calls](https://discuss.elastic.co/t/varying-result-size-per-in-calls/266255)
**Author:** [@malik\_aditya](https://discuss.elastic.co/u/malik_aditya)\ **Replies:** 2\ **Last updated:** [March 15, 2021, 8:58am UTC](https://discuss.elastic.co/t/varying-result-size-per-in-calls/266255 "2021-03-15T08:58:19Z")
I am using AppSearch and the requirement is to fetch varying result sizes per call. Like on first call I need three records and on each successive calls I need 6 records. I checked documentation and there is no facility … --- ## [Elasticsearch single node is occasionally loaded very high](https://discuss.elastic.co/t/elasticsearch-single-node-is-occasionally-loaded-very-high/266904)
**Author:** [@bxl](https://discuss.elastic.co/u/bxl)\ **Replies:** 6\ **Last updated:** [March 15, 2021, 8:15am UTC](https://discuss.elastic.co/t/elasticsearch-single-node-is-occasionally-loaded-very-high/266904 "2021-03-15T08:15:15Z")
Hi, My ES cluster is used to store logs. When writing data in graylog, I found that occasionally the load of a node would suddenly increase, affecting the data written to the whole cluster. The node did not have gc, and… --- ## [How can resume logstash pipeline after terminated or crashed?](https://discuss.elastic.co/t/how-can-resume-logstash-pipeline-after-terminated-or-crashed/267029)
**Author:** [@Sage](https://discuss.elastic.co/u/Sage)\ **Replies:** 2\ **Last updated:** [March 15, 2021, 7:22am UTC](https://discuss.elastic.co/t/how-can-resume-logstash-pipeline-after-terminated-or-crashed/267029 "2021-03-15T07:22:35Z")
I designed a pipeline with elasticsearch as a input plugin and s3 as a output plugin. In my case, pipeline started successfully and push the data on s3 bucket but in case of termination or crash it does not start from wh… --- ## [Filebeat with a combination of netflow and iis](https://discuss.elastic.co/t/filebeat-with-a-combination-of-netflow-and-iis/267131)
**Author:** [@VamPikmin](https://discuss.elastic.co/u/VamPikmin)\ **Replies:** 2\ **Last updated:** [March 15, 2021, 7:21am UTC](https://discuss.elastic.co/t/filebeat-with-a-combination-of-netflow-and-iis/267131 "2021-03-15T07:21:22Z")
Hi everyone, I have an ELK stack running on Ubuntu 20.04 server which is currently ingesting Filebeat IIS logs from a Windows machine. When I run the filebeat setup command from the Linux server to install the dashboar… --- ## [I have servers data im visulaizing them in kibana. I used Top hit as the aggregation metric for last updated time. In the buckets i have other fields to look at the data like a table. But im getting duplicates how do i get rid of this](https://discuss.elastic.co/t/i-have-servers-data-im-visulaizing-them-in-kibana-i-used-top-hit-as-the-aggregation-metric-for-last-updated-time-in-the-buckets-i-have-other-fields-to-look-at-the-data-like-a-table-but-im-getting-duplicates-how-do-i-get-rid-of-this/267094)
**Author:** [@sagar\_rao](https://discuss.elastic.co/u/sagar_rao)\ **Replies:** 2\ **Last updated:** [March 15, 2021, 6:47am UTC](https://discuss.elastic.co/t/i-have-servers-data-im-visulaizing-them-in-kibana-i-used-top-hit-as-the-aggregation-metric-for-last-updated-time-in-the-buckets-i-have-other-fields-to-look-at-the-data-like-a-table-but-im-getting-duplicates-how-do-i-get-rid-of-this/267094 "2021-03-15T06:47:08Z")
--- ## [java.lang.RuntimeException - I/O reactor status: STOPPED](https://discuss.elastic.co/t/java-lang-runtimeexception-i-o-reactor-status-stopped/267222)
**Author:** [@Sriram8894](https://discuss.elastic.co/u/Sriram8894)\ **Replies:** 0\ **Last updated:** [March 15, 2021, 6:35am UTC](https://discuss.elastic.co/t/java-lang-runtimeexception-i-o-reactor-status-stopped/267222 "2021-03-15T06:35:30Z")
We are getting the below error while executing the search requests. We are using ElasticSearch 7.6v java.lang.RuntimeException: Request cannot be executed; I/O reactor status: STOPPED We are only using sync method to … --- ## [Configuration of elastic search using organisation specific certificates](https://discuss.elastic.co/t/configuration-of-elastic-search-using-organisation-specific-certificates/267223)
**Author:** [@Srinivas1602](https://discuss.elastic.co/u/Srinivas1602)\ **Replies:** 0\ **Last updated:** [March 15, 2021, 6:36am UTC](https://discuss.elastic.co/t/configuration-of-elastic-search-using-organisation-specific-certificates/267223 "2021-03-15T06:36:38Z")
Hi. I have a 3 node cluster setup with 2 data nodes and 1 master node setup running with tls/ssl/https enabled with the help of Elasticsearch offical documentation. However I would like to use our internal organisation… --- ## [Cluster Nodes are not reflecting](https://discuss.elastic.co/t/cluster-nodes-are-not-reflecting/267194)
**Author:** [@roh689](https://discuss.elastic.co/u/roh689)\ **Replies:** 4\ **Last updated:** [March 15, 2021, 5:07am UTC](https://discuss.elastic.co/t/cluster-nodes-are-not-reflecting/267194 "2021-03-15T05:07:43Z")
We were using elasticsearch with only 1 node i.e. ES01 which also have log data of almost 2 weeks. Now we are trying to expand to 3 nodes with additional 2 servers i.e. ES02 & ES03, configured yml files on these 2 server… --- ## [License for SSO option alone](https://discuss.elastic.co/t/license-for-sso-option-alone/267049)
**Author:** [@raja.parameswaran](https://discuss.elastic.co/u/raja.parameswaran)\ **Replies:** 4\ **Last updated:** [March 15, 2021, 3:39am UTC](https://discuss.elastic.co/t/license-for-sso-option-alone/267049 "2021-03-15T03:39:31Z")
Hi, I am new to Elastic Stack. We are looking at embedding Kibana dashboard inside our application. We are planning to go with the Basic version of Elastic stack(free version) to begin with. However, we want to have the… --- ## [Can we have default filter?](https://discuss.elastic.co/t/can-we-have-default-filter/266205)
**Author:** [@Abhishek\_Vyas1](https://discuss.elastic.co/u/Abhishek_Vyas1)\ **Replies:** 2\ **Last updated:** [March 15, 2021, 3:33am UTC](https://discuss.elastic.co/t/can-we-have-default-filter/266205 "2021-03-15T03:33:40Z")
Is it possible to have a default filter that is hidden from dash board. Mainly the need is as follows :- we have key name area which have 4 different values (as A,B,C,D). So whenever user choose a given area in front e… --- ## [3 nodes in the cluster, 2 data and 1 master - why if one fails it takes the whole cluster down?](https://discuss.elastic.co/t/3-nodes-in-the-cluster-2-data-and-1-master-why-if-one-fails-it-takes-the-whole-cluster-down/267165)
**Author:** [@lamp123432](https://discuss.elastic.co/u/lamp123432)\ **Replies:** 14\ **Last updated:** [March 15, 2021, 3:27am UTC](https://discuss.elastic.co/t/3-nodes-in-the-cluster-2-data-and-1-master-why-if-one-fails-it-takes-the-whole-cluster-down/267165 "2021-03-15T03:27:24Z")
Hello, I have 3 nodes; 2 data nodes and 1 master node. When one of the data nodes fails, the whole cluster stops processing data, nothing is shown in Kibana anymore, even though a data node is working and receiving data… --- ## [APM Server queue is full](https://discuss.elastic.co/t/apm-server-queue-is-full/266866)
**Author:** [@rp346](https://discuss.elastic.co/u/rp346)\ **Replies:** 1\ **Last updated:** [March 15, 2021, 2:27am UTC](https://discuss.elastic.co/t/apm-server-queue-is-full/266866 "2021-03-15T02:27:39Z")
I have setup APM Server along with EBK stack. APM server has following configuration apm-server.ymlapm-server: host: "0.0.0.0:8200" frontend: enabled: false setup.template.settings: … --- ## [ES 7.7.0 / LS 7.7.0 - Logstash not writing to a green index when some data nodes are down](https://discuss.elastic.co/t/es-7-7-0-ls-7-7-0-logstash-not-writing-to-a-green-index-when-some-data-nodes-are-down/267205)
**Author:** [@ld\_pvl](https://discuss.elastic.co/u/ld_pvl)\ **Replies:** 0\ **Last updated:** [March 14, 2021, 11:49pm UTC](https://discuss.elastic.co/t/es-7-7-0-ls-7-7-0-logstash-not-writing-to-a-green-index-when-some-data-nodes-are-down/267205 "2021-03-14T23:49:55Z")
Hi Team, I had a strange problem the other day and could not figure out what was happening. In my cluster, about 30% of my data nodes were brought down (intentionally). The cluster became red as expected but still had … --- ## [How to use Elastic APM to collect performance for example from zabbix](https://discuss.elastic.co/t/how-to-use-elastic-apm-to-collect-performance-for-example-from-zabbix/267087)
**Author:** [@francieliton\_araujo](https://discuss.elastic.co/u/francieliton_araujo)\ **Replies:** 2\ **Last updated:** [March 14, 2021, 9:43pm UTC](https://discuss.elastic.co/t/how-to-use-elastic-apm-to-collect-performance-for-example-from-zabbix/267087 "2021-03-14T21:43:29Z")
This subject of APM is very new to me, I would like to know how do I monitor a zabbix application. I see several examples but everything is used an application created by the person himself. I work with monitoring and fo… --- ## [Minimum grants required for application user to manipulate indices data](https://discuss.elastic.co/t/minimum-grants-required-for-application-user-to-manipulate-indices-data/267201)
**Author:** [@raulk89](https://discuss.elastic.co/u/raulk89)\ **Replies:** 0\ **Last updated:** [March 14, 2021, 8:08pm UTC](https://discuss.elastic.co/t/minimum-grants-required-for-application-user-to-manipulate-indices-data/267201 "2021-03-14T20:08:55Z")
Hi Elastic 7.11.1 When enable-ing security on my elastic cluster. Then applications that access data, need to have an user for these operations. My question is, what would be the minimum roles/grants that need to be a… --- ## [Vertical Bar Unique Count all counts = 1](https://discuss.elastic.co/t/vertical-bar-unique-count-all-counts-1/264171)
**Author:** [@j4sper](https://discuss.elastic.co/u/j4sper)\ **Replies:** 6\ **Last updated:** [March 14, 2021, 6:06pm UTC](https://discuss.elastic.co/t/vertical-bar-unique-count-all-counts-1/264171 "2021-03-14T18:06:29Z")
I'm trying to visualize dns log data in a vertical chart. X-axis should be remote\_host. Y-axis should be count of remote\_host. I do this by setting Data -\> Metrics -\> Y-axis -\> Aggregation to Unique Count and Field to r… --- ## [Csv to float from logstash to elasticsearch](https://discuss.elastic.co/t/csv-to-float-from-logstash-to-elasticsearch/267105)
**Author:** [@ofitz](https://discuss.elastic.co/u/ofitz)\ **Replies:** 4\ **Last updated:** [March 14, 2021, 3:48pm UTC](https://discuss.elastic.co/t/csv-to-float-from-logstash-to-elasticsearch/267105 "2021-03-14T15:48:39Z")
I have some problems to read CSV and convert the values as float in Array My Demo Dataset: 215900;216100;216300;216430; 216750;216950;217230;217500; 217780;217930;218100;218250; My logstash Config: input { file { … --- ## [Update all collection based on pattern](https://discuss.elastic.co/t/update-all-collection-based-on-pattern/267199)
**Author:** [@ClubberLang](https://discuss.elastic.co/u/ClubberLang)\ **Replies:** 0\ **Last updated:** [March 14, 2021, 5:47pm UTC](https://discuss.elastic.co/t/update-all-collection-based-on-pattern/267199 "2021-03-14T17:47:54Z")
Hi, I have a several indexes, they all contains data such this one: { "\_index" : "item\_index", "imageUri" : "https://cdn.socloze.com/cdn/e\_07266e9e-d294.jpg" ... } and I wish to convert all the "/cdn/" into "/v1/c… --- ## [Schedule ElasticSearch 6.1.2 snapshots](https://discuss.elastic.co/t/schedule-elasticsearch-6-1-2-snapshots/267154)
**Author:** [@mwise29](https://discuss.elastic.co/u/mwise29)\ **Replies:** 4\ **Last updated:** [March 14, 2021, 4:56pm UTC](https://discuss.elastic.co/t/schedule-elasticsearch-6-1-2-snapshots/267154 "2021-03-14T16:56:28Z")
We have an older ElasticSearch cluster that is currently running version 6.1.2. I noticed it didn't have any snapshots of the data. SLM isn't supported with that version so I was wondering how snapshots could be schedu… --- ## [Elastic TLS: "xpack.security.http.ssl.enabled: true" vs proxy](https://discuss.elastic.co/t/elastic-tls-xpack-security-http-ssl-enabled-true-vs-proxy/267197)
**Author:** [@raulk89](https://discuss.elastic.co/u/raulk89)\ **Replies:** 0\ **Last updated:** [March 14, 2021, 4:39pm UTC](https://discuss.elastic.co/t/elastic-tls-xpack-security-http-ssl-enabled-true-vs-proxy/267197 "2021-03-14T16:39:43Z")
Hi Elastic 7.11.1 Planning on configuring TLS for elasticsearch port 9200 I was wondering, is there a difference, whether I configure TLS with: elasticsearch.yml: xpack.security.http.ssl.enabled: true or via apache/… --- ## [How hot node differ from warm node](https://discuss.elastic.co/t/how-hot-node-differ-from-warm-node/267186)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 4\ **Last updated:** [March 14, 2021, 4:40pm UTC](https://discuss.elastic.co/t/how-hot-node-differ-from-warm-node/267186 "2021-03-14T16:40:00Z")
Total index=25 Logs/day=50gbx2(copies)=100gb Shards/day=25x2=50 shards Log retention 60 days Logs for 60 days=100x60=6Tb Shards for 60 days=50x60=3000 So we are planning to use 3 master node with 8gb heap 6 hot dat… --- ## [Elasticsearch shards size increase sometimes](https://discuss.elastic.co/t/elasticsearch-shards-size-increase-sometimes/267188)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 4\ **Last updated:** [March 14, 2021, 4:01pm UTC](https://discuss.elastic.co/t/elasticsearch-shards-size-increase-sometimes/267188 "2021-03-14T16:01:14Z")
I have a time based index called log-wlb-sysmon-2021.03.13 its index size is 19gb with replication 38gb.I created 2 shards(1p+1r) Sometimes its size increases from 38gb to 44gb.I am using ilm policy for this index in th… --- ## [Filebeat error](https://discuss.elastic.co/t/filebeat-error/267193)
**Author:** [@Boris\_Becker](https://discuss.elastic.co/u/Boris_Becker)\ **Replies:** 0\ **Last updated:** [March 14, 2021, 3:21pm UTC](https://discuss.elastic.co/t/filebeat-error/267193 "2021-03-14T15:21:15Z")
Do filebeat connected to logstash if it got the error (how it can be fixed?): 2021-03-14T15:06:08.306Z ERROR \[publisher\_pipeline\_output\] pipeline/output.go:154 Failed to connect to backoff(elasticsearch(https://vpc-au… [Previous page](https://discuss.elastic.co/latest.md?page=1784) [Next page](https://discuss.elastic.co/latest.md?page=1786)