# Latest **URL:** https://discuss.elastic.co/latest.md?page=1821 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1822 --- ## [How to add warm nodes to an existing cluster](https://discuss.elastic.co/t/how-to-add-warm-nodes-to-an-existing-cluster/265164)
**Author:** [@haipeng.zhao](https://discuss.elastic.co/u/haipeng.zhao)\ **Replies:** 3\ **Last updated:** [February 23, 2021, 1:47pm UTC](https://discuss.elastic.co/t/how-to-add-warm-nodes-to-an-existing-cluster/265164 "2021-02-23T13:47:06Z")
HI all： I have created the entire es cluster. There are currently three masters and three hot nodes. I want to add warm nodes to the existing eck cluster. What should I do? --- ## [Filebeat not starting log aggregation on some kubernetes worker nodes](https://discuss.elastic.co/t/filebeat-not-starting-log-aggregation-on-some-kubernetes-worker-nodes/265204)
**Author:** [@lbenton](https://discuss.elastic.co/u/lbenton)\ **Replies:** 0\ **Last updated:** [February 23, 2021, 1:26pm UTC](https://discuss.elastic.co/t/filebeat-not-starting-log-aggregation-on-some-kubernetes-worker-nodes/265204 "2021-02-23T13:26:55Z")
Hi All, I've run into an issue with filebeat in kubernetes, but only on some worker nodes. If useful, here's a bit of background -Deployed using helm, via terraform -currently 16 worker nodes, 7 of which filebeat ref… --- ## [How to check if a master node auto-election is enabled?](https://discuss.elastic.co/t/how-to-check-if-a-master-node-auto-election-is-enabled/265197)
**Author:** [@Manikandan\_Kbk](https://discuss.elastic.co/u/Manikandan_Kbk)\ **Replies:** 5\ **Last updated:** [February 23, 2021, 12:48pm UTC](https://discuss.elastic.co/t/how-to-check-if-a-master-node-auto-election-is-enabled/265197 "2021-02-23T12:48:27Z")
We have installed ES 6.2.4 and have 3 master node setup. Is there a way to check if auto-election of master node is enabled in case active master goes down? do elastic search always do auto-election (or) disabling auto… --- ## [Ingest Pipeline, set field derived from another](https://discuss.elastic.co/t/ingest-pipeline-set-field-derived-from-another/265195)
**Author:** [@nberens](https://discuss.elastic.co/u/nberens)\ **Replies:** 2\ **Last updated:** [February 23, 2021, 12:25pm UTC](https://discuss.elastic.co/t/ingest-pipeline-set-field-derived-from-another/265195 "2021-02-23T12:25:14Z")
Hello, i am currently building a new pipeline for filebeat where we ingest a lot of different logfiles, e.g. /log/appname1.log /log/appname2.log etc now i want a field in every document that says: app: appname1 So… --- ## [Elasticsearch only binds to localhost but not IP / hostname / fqdn hostname - WHY?](https://discuss.elastic.co/t/elasticsearch-only-binds-to-localhost-but-not-ip-hostname-fqdn-hostname-why/265198)
**Author:** [@smm](https://discuss.elastic.co/u/smm)\ **Replies:** 7\ **Last updated:** [February 23, 2021, 12:20pm UTC](https://discuss.elastic.co/t/elasticsearch-only-binds-to-localhost-but-not-ip-hostname-fqdn-hostname-why/265198 "2021-02-23T12:20:55Z")
Hi there, I am wondering: build a multinode stack. On a stack I would llike to to a: curl -s -k -u elastic:changeme -XGET https://SOMETHING:9200/\_cat/health If SOMETHING is: 127.0.0.1 or localhost it works machine i… --- ## [Preventing SearchPhaseExecutionExceptions during rolling restart of cluster nodes](https://discuss.elastic.co/t/preventing-searchphaseexecutionexceptions-during-rolling-restart-of-cluster-nodes/265182)
**Author:** [@amishar](https://discuss.elastic.co/u/amishar)\ **Replies:** 1\ **Last updated:** [February 23, 2021, 12:06pm UTC](https://discuss.elastic.co/t/preventing-searchphaseexecutionexceptions-during-rolling-restart-of-cluster-nodes/265182 "2021-02-23T12:06:18Z")
Several Scroll Search requests fail with SearchPhaseExecutionException around the time when there is a rolling restart of the nodes in the cluster(ES 6.8). These SearchPhaseExecution exception has an underlying cause tha… --- ## [Disable username/password for eck](https://discuss.elastic.co/t/disable-username-password-for-eck/265160)
**Author:** [@benjaminhuo](https://discuss.elastic.co/u/benjaminhuo)\ **Replies:** 2\ **Last updated:** [February 23, 2021, 12:04pm UTC](https://discuss.elastic.co/t/disable-username-password-for-eck/265160 "2021-02-23T12:04:48Z")
Is it possible to disable username and password for https://github.com/elastic/cloud-on-k8s ? --- ## [Aggregation - Multiplication of multiple nested fields and sum](https://discuss.elastic.co/t/aggregation-multiplication-of-multiple-nested-fields-and-sum/265199)
**Author:** [@krishnapss](https://discuss.elastic.co/u/krishnapss)\ **Replies:** 0\ **Last updated:** [February 23, 2021, 11:50am UTC](https://discuss.elastic.co/t/aggregation-multiplication-of-multiple-nested-fields-and-sum/265199 "2021-02-23T11:50:40Z")
Hi, Could you please help me to solve this problem. Really appreciate your help. I want to multiply and sum of two properties (or fields). One is from main object and another one is from nested object. History object c… --- ## [Heatmap - There are too many series defined](https://discuss.elastic.co/t/heatmap-there-are-too-many-series-defined/263265)
**Author:** [@jamie0691](https://discuss.elastic.co/u/jamie0691)\ **Replies:** 2\ **Last updated:** [February 23, 2021, 11:22am UTC](https://discuss.elastic.co/t/heatmap-there-are-too-many-series-defined/263265 "2021-02-23T11:22:09Z")
Trying to create a heatmap and get the error - There are too many series defined. Having look on the GitHub this was fixed under https://github.com/elastic/kibana/pull/39578, I am running version 7.1.1 and the setting un… --- ## [Elasticsearch WARN : Failed to update shard information for ClusterInfoUpdateJob within 15s timeout](https://discuss.elastic.co/t/elasticsearch-warn-failed-to-update-shard-information-for-clusterinfoupdatejob-within-15s-timeout/265192)
**Author:** [@Farzad\_Ebrahimi](https://discuss.elastic.co/u/Farzad_Ebrahimi)\ **Replies:** 0\ **Last updated:** [February 23, 2021, 11:06am UTC](https://discuss.elastic.co/t/elasticsearch-warn-failed-to-update-shard-information-for-clusterinfoupdatejob-within-15s-timeout/265192 "2021-02-23T11:06:27Z")
Hi every one, i am running elasticsearch 7.10 on windows server 2016. elasticsearch installed as a service and worked well. but in elastic logs i see this warnings: \[2021-02-23T13:12:06,472\]\[WARN \]\[o.e.c.InternalCluste… --- ## [ERROR accessing platform after changing Deployments domain name (adding :443 to the end)](https://discuss.elastic.co/t/error-accessing-platform-after-changing-deployments-domain-name-adding-443-to-the-end/265189)
**Author:** [@canti](https://discuss.elastic.co/u/canti)\ **Replies:** 0\ **Last updated:** [February 23, 2021, 10:24am UTC](https://discuss.elastic.co/t/error-accessing-platform-after-changing-deployments-domain-name-adding-443-to-the-end/265189 "2021-02-23T10:24:17Z")
Hi , after changing deployment name from "my-deployment.domain.com" to "my-deployment.domain.com:443" , got this error "There was an internal server error. " but the change is made. Anywayt, after that i cannot change… --- ## [High availability of system indices: how-to mitigate system index failures](https://discuss.elastic.co/t/high-availability-of-system-indices-how-to-mitigate-system-index-failures/265082)
**Author:** [@bertr](https://discuss.elastic.co/u/bertr)\ **Replies:** 5\ **Last updated:** [February 23, 2021, 10:23am UTC](https://discuss.elastic.co/t/high-availability-of-system-indices-how-to-mitigate-system-index-failures/265082 "2021-02-23T10:23:10Z")
I notice that system indices in Elasticsearch have "index.number\_of\_replicas": "0" and this cannot be updated. Is there a reason why this cannot be set to 1 (or more) and how safe is it to have no replicas for system ind… --- ## [Filter document with not null value in Kibana Discover. Should I use "exist", but it still return me docs with empty field](https://discuss.elastic.co/t/filter-document-with-not-null-value-in-kibana-discover-should-i-use-exist-but-it-still-return-me-docs-with-empty-field/265103)
**Author:** [@qub123](https://discuss.elastic.co/u/qub123)\ **Replies:** 3\ **Last updated:** [February 23, 2021, 9:47am UTC](https://discuss.elastic.co/t/filter-document-with-not-null-value-in-kibana-discover-should-i-use-exist-but-it-still-return-me-docs-with-empty-field/265103 "2021-02-23T09:47:22Z")
Hi, I am trying to filter out field without "null/empty" value in Kibana, but when I try to use operator exist. THen it still show me docs without any value. Just wondering is there a way to filter only see documents wi… --- ## [Sorting based on scripted metrics aggregation](https://discuss.elastic.co/t/sorting-based-on-scripted-metrics-aggregation/262384)
**Author:** [@Abbass](https://discuss.elastic.co/u/Abbass)\ **Replies:** 2\ **Last updated:** [February 23, 2021, 9:45am UTC](https://discuss.elastic.co/t/sorting-based-on-scripted-metrics-aggregation/262384 "2021-02-23T09:45:25Z")
Hello! I faced a limitation on sorting buckets of a term aggrigation, based on a scripted metrics sub aggregation values. This issue clearly states that it is not possible to do this in elasticsearch. However, i mana… --- ## [Limiting the time range filter](https://discuss.elastic.co/t/limiting-the-time-range-filter/265162)
**Author:** [@Amphagory](https://discuss.elastic.co/u/Amphagory)\ **Replies:** 1\ **Last updated:** [February 23, 2021, 9:43am UTC](https://discuss.elastic.co/t/limiting-the-time-range-filter/265162 "2021-02-23T09:43:16Z")
Issue: I have set up a visual with data histogram on the x-axis. From time to time, it returns an error saying too many buckets. Possible solutions: Limit the time range filter to say the last week? month? year? in … --- ## [Error: A plugin had an unrecoverable error. Will restart this plugin](https://discuss.elastic.co/t/error-a-plugin-had-an-unrecoverable-error-will-restart-this-plugin/265101)
**Author:** [@jaispirit](https://discuss.elastic.co/u/jaispirit)\ **Replies:** 2\ **Last updated:** [February 23, 2021, 9:37am UTC](https://discuss.elastic.co/t/error-a-plugin-had-an-unrecoverable-error-will-restart-this-plugin/265101 "2021-02-23T09:37:49Z")
I am running Elastick-Stack with Security on a single node successfully. I am trying to send logs from another instance with Filebeat to Logstash (Elastic-Stack) without success and receive following 2 errors: \[ERROR\]… --- ## [Elasticsearch terms query is very slow?](https://discuss.elastic.co/t/elasticsearch-terms-query-is-very-slow/265169)
**Author:** [@Karthick\_K](https://discuss.elastic.co/u/Karthick_K)\ **Replies:** 5\ **Last updated:** [February 23, 2021, 9:24am UTC](https://discuss.elastic.co/t/elasticsearch-terms-query-is-very-slow/265169 "2021-02-23T09:24:25Z")
Elasticsearch cluster Master node : 1 (16cpus, 128GB RAM) - 32GB is allocated for HEAP Data nodes : 6 (each node 16cpus, 128GB RAM) - 32GB is allocated for HEAP for all nodes Indices : 9 Total documents : 48,826,456… --- ## [We cannot see the variables we want in the available field section](https://discuss.elastic.co/t/we-cannot-see-the-variables-we-want-in-the-available-field-section/265089)
**Author:** [@eceguzeell](https://discuss.elastic.co/u/eceguzeell)\ **Replies:** 2\ **Last updated:** [February 23, 2021, 9:04am UTC](https://discuss.elastic.co/t/we-cannot-see-the-variables-we-want-in-the-available-field-section/265089 "2021-02-23T09:04:18Z")
We cannot see the variables we want in the available field section. I can see the logs I want in the Discover section. But I cannot see all of these logs while designing graphics in the dashboard. E.g; The log example … --- ## [Query to return a result set bounded by a fixed number of zeros (no rainfall)](https://discuss.elastic.co/t/query-to-return-a-result-set-bounded-by-a-fixed-number-of-zeros-no-rainfall/264992)
**Author:** [@rosselton](https://discuss.elastic.co/u/rosselton)\ **Replies:** 3\ **Last updated:** [February 23, 2021, 9:03am UTC](https://discuss.elastic.co/t/query-to-return-a-result-set-bounded-by-a-fixed-number-of-zeros-no-rainfall/264992 "2021-02-23T09:03:05Z")
I'm using ES to store rainfall data from a weather API that updates every 10 minutes. I'm trying to write a query to return a set of records where a spell of dry weather ( 30 consecutive rain values in the range of 0 to … --- ## [Update items in a rolled-over index](https://discuss.elastic.co/t/update-items-in-a-rolled-over-index/265087)
**Author:** [@Jorge\_Ruiz](https://discuss.elastic.co/u/Jorge_Ruiz)\ **Replies:** 6\ **Last updated:** [February 23, 2021, 8:37am UTC](https://discuss.elastic.co/t/update-items-in-a-rolled-over-index/265087 "2021-02-23T08:37:51Z")
Hi there! A quick and simple question related to rolled-over indexes. Is it a good approach to have a rollover index if, eventually, we want to update items that belong to an already completed index (rolled-over)? As f… --- ## [Terminate\_after with aggregation](https://discuss.elastic.co/t/terminate-after-with-aggregation/265179)
**Author:** [@dobkum](https://discuss.elastic.co/u/dobkum)\ **Replies:** 0\ **Last updated:** [February 23, 2021, 8:32am UTC](https://discuss.elastic.co/t/terminate-after-with-aggregation/265179 "2021-02-23T08:32:52Z")
I want to know how aggregation behaves when combined with terminate\_after. Is it that first the aggregations are performed from records belonging to all shards and then terminate\_after setting are applied or first the… --- ## [Transformed index is missing data](https://discuss.elastic.co/t/transformed-index-is-missing-data/264725)
**Author:** [@kazuki](https://discuss.elastic.co/u/kazuki)\ **Replies:** 3\ **Last updated:** [February 23, 2021, 8:20am UTC](https://discuss.elastic.co/t/transformed-index-is-missing-data/264725 "2021-02-23T08:20:53Z")
We have a transform that creates aggregation based on userId and clientID from a source index and write to a destination index. We've noticed the destination index is missing data it should have even after waiting 10+ mi… --- ## [Memory lock check on Elastic Cloud](https://discuss.elastic.co/t/memory-lock-check-on-elastic-cloud/264867)
**Author:** [@val](https://discuss.elastic.co/u/val)\ **Replies:** 7\ **Last updated:** [February 23, 2021, 7:41am UTC](https://discuss.elastic.co/t/memory-lock-check-on-elastic-cloud/264867 "2021-02-23T07:41:52Z")
I'm curious how it is possible that a cluster on Elastic Cloud passes the memory lock bootstrap check even though the memory doesn't seem to be locked. Here is the mlockall state on all nodes GET \_nodes?filter\_path=\*\*.… --- ## [Beginner Questions - Interaction Filebeat and Modules and General Q](https://discuss.elastic.co/t/beginner-questions-interaction-filebeat-and-modules-and-general-q/265173)
**Author:** [@maxxlight](https://discuss.elastic.co/u/maxxlight)\ **Replies:** 0\ **Last updated:** [February 23, 2021, 7:35am UTC](https://discuss.elastic.co/t/beginner-questions-interaction-filebeat-and-modules-and-general-q/265173 "2021-02-23T07:35:49Z")
Hey, im new to ELK Stack and installed a Linux Server with Filebeat, Logstash, Elastic and Kibana. I want to get the syslog and netflow Streams from Palo Alto FW / Cisco 2900 Series / WLAN and some more other Syslog D… --- ## [Filter issue with Logstash](https://discuss.elastic.co/t/filter-issue-with-logstash/265171)
**Author:** [@nyquillus](https://discuss.elastic.co/u/nyquillus)\ **Replies:** 0\ **Last updated:** [February 23, 2021, 7:31am UTC](https://discuss.elastic.co/t/filter-issue-with-logstash/265171 "2021-02-23T07:31:54Z")
Hi, I recently added a filter to my logstash to change indexing for spesific indices(weekly, monthly etc.) The filter is this: filter { if \[retention\] == "weekly" { mutate { add\_field =\> { "\[@metadata\]… --- ## [How to config TLS/SSL on single node?](https://discuss.elastic.co/t/how-to-config-tls-ssl-on-single-node/265064)
**Author:** [@MABN](https://discuss.elastic.co/u/MABN)\ **Replies:** 2\ **Last updated:** [February 23, 2021, 7:30am UTC](https://discuss.elastic.co/t/how-to-config-tls-ssl-on-single-node/265064 "2021-02-23T07:30:56Z")
Hi I use ELK 7.10 single node ( all ELK are installed on one OS) How to config TLS/SSL on single node? Should I do that and is it necessary? It is important to mention I access kibana and elastic from remote computer… --- ## [JVM crash with JRE 7 and profiling\_inferred\_spans\_enabled](https://discuss.elastic.co/t/jvm-crash-with-jre-7-and-profiling-inferred-spans-enabled/264871)
**Author:** [@Charles\_Porter](https://discuss.elastic.co/u/Charles_Porter)\ **Replies:** 5\ **Last updated:** [February 23, 2021, 7:02am UTC](https://discuss.elastic.co/t/jvm-crash-with-jre-7-and-profiling-inferred-spans-enabled/264871 "2021-02-23T07:02:38Z")
Hello. We're currently testing out Elastic APM in our java-based test environment for an application my team supports. One of the application components runs in a Java 7 environment. We initially encountered issue 1583,… --- ## [Kibana Cases Analytics](https://discuss.elastic.co/t/kibana-cases-analytics/265116)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 5\ **Last updated:** [February 23, 2021, 6:55am UTC](https://discuss.elastic.co/t/kibana-cases-analytics/265116 "2021-02-23T06:55:39Z")
Hello, I need to do some basic analytics on the Kibana cases we created until now. Where are these cases indexed? For example I added some tags and I want to visualise the amount of cases out of all cases that have cert… --- ## [Filebeat kafka output hash.hash get negative partition cause stuck](https://discuss.elastic.co/t/filebeat-kafka-output-hash-hash-get-negative-partition-cause-stuck/265153)
**Author:** [@Vvv](https://discuss.elastic.co/u/Vvv)\ **Replies:** 0\ **Last updated:** [February 23, 2021, 5:27am UTC](https://discuss.elastic.co/t/filebeat-kafka-output-hash-hash-get-negative-partition-cause-stuck/265153 "2021-02-23T05:27:58Z")
Summarry I use filebeat to collect logs and output to kafka. Due to partition.hash.hash config hash message then mod to select partition, in some situation, this may cause filebeat stuck, e.g.: massage: 2304669687 hash… --- ## [Problem with xpack maps app when configured document layer with remote index pattern](https://discuss.elastic.co/t/problem-with-xpack-maps-app-when-configured-document-layer-with-remote-index-pattern/264426)
**Author:** [@nrt.krishna](https://discuss.elastic.co/u/nrt.krishna)\ **Replies:** 2\ **Last updated:** [February 23, 2021, 6:05am UTC](https://discuss.elastic.co/t/problem-with-xpack-maps-app-when-configured-document-layer-with-remote-index-pattern/264426 "2021-02-23T06:05:32Z")
I am trying to configure a document layer with an index pattern which is in remote cluster. I am getting below exception. Unable to fetch index settings for index pattern '\'. Ensure you ha… [Previous page](https://discuss.elastic.co/latest.md?page=1820) [Next page](https://discuss.elastic.co/latest.md?page=1822)