# Latest **URL:** https://discuss.elastic.co/latest.md?page=1826 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1827 --- ## [Elasticsearch cluster performance degradation](https://discuss.elastic.co/t/elasticsearch-cluster-performance-degradation/264915)
**Author:** [@mario12](https://discuss.elastic.co/u/mario12)\ **Replies:** 5\ **Last updated:** [February 22, 2021, 2:37am UTC](https://discuss.elastic.co/t/elasticsearch-cluster-performance-degradation/264915 "2021-02-22T02:37:01Z")
We had a performance degradation for 5-10 minutes intervals. We looked into our monitoring tool and found there was high CPU utilization on the elasticsearch cluster. During this time we also noticed high fetch requests … --- ## [Search For a string in scripted index](https://discuss.elastic.co/t/search-for-a-string-in-scripted-index/264506)
**Author:** [@yash\_gupta](https://discuss.elastic.co/u/yash_gupta)\ **Replies:** 11\ **Last updated:** [February 22, 2021, 1:19am UTC](https://discuss.elastic.co/t/search-for-a-string-in-scripted-index/264506 "2021-02-22T01:19:25Z")
Hi, I need to search for a string in a field of an index using a scripted filed, below is how it looks like. build\_info.causes { "cause\_class": "some vaue", "short\_description": "Triggered by Gerrit: some value ." } … --- ## [Jre crash after running for days or hours](https://discuss.elastic.co/t/jre-crash-after-running-for-days-or-hours/262439)
**Author:** [@billhong-just](https://discuss.elastic.co/u/billhong-just)\ **Replies:** 8\ **Last updated:** [February 22, 2021, 1:19am UTC](https://discuss.elastic.co/t/jre-crash-after-running-for-days-or-hours/262439 "2021-02-22T01:19:19Z")
Hi community, My single node elasticsearch cluster crashed after running for days or hours. And here are relevant information and logs. Elasticsearch version (bin/elasticsearch --version): 7.10.2 Plugins installed: I… --- ## [Could not connect to SMTP host: xxx, port: nn, response: 554](https://discuss.elastic.co/t/could-not-connect-to-smtp-host-xxx-port-nn-response-554/264761)
**Author:** [@xyz2](https://discuss.elastic.co/u/xyz2)\ **Replies:** 1\ **Last updated:** [February 22, 2021, 12:56am UTC](https://discuss.elastic.co/t/could-not-connect-to-smtp-host-xxx-port-nn-response-554/264761 "2021-02-22T00:56:38Z")
Hi, I am getting below error on watcher email alert. Hosts and port are defined in elasticsearch.yml Could not connect to SMTP host: xxx, port: nn, response: 554" smtp: auth: False starttls.enable: False --- ## [Logstash conditional output](https://discuss.elastic.co/t/logstash-conditional-output/264826)
**Author:** [@petegriggs](https://discuss.elastic.co/u/petegriggs)\ **Replies:** 6\ **Last updated:** [February 22, 2021, 12:54am UTC](https://discuss.elastic.co/t/logstash-conditional-output/264826 "2021-02-22T00:54:11Z")
Hello, Looking to use logstash to host multiple syslog listeners to start to aggregate logs from different vendors and then forward on for now to another syslog server. The question is whether we can set the syslog out… --- ## [FileBeat Setup Error : error loading index pattern: returned 413 to import file: \. Response: {"statusCode":413,"error":"Request Entity Too Large","message":"Payload content length greater than maximum allowed: 1048576"](https://discuss.elastic.co/t/filebeat-setup-error-error-loading-index-pattern-returned-413-to-import-file-nil-response-statuscode-413-error-request-entity-too-large-message-payload-content-length-greater-than-maximum-allowed-1048576/264845)
**Author:** [@Biswabhusan\_Dash](https://discuss.elastic.co/u/Biswabhusan_Dash)\ **Replies:** 1\ **Last updated:** [February 22, 2021, 12:51am UTC](https://discuss.elastic.co/t/filebeat-setup-error-error-loading-index-pattern-returned-413-to-import-file-nil-response-statuscode-413-error-request-entity-too-large-message-payload-content-length-greater-than-maximum-allowed-1048576/264845 "2021-02-22T00:51:37Z")
We are working to capture logs from server to elasticsearch by filebeat. We are getting below issue, while setup the filebeat. Response: {"statusCode":413,"error":"Request Entity Too Large","message":"Payload content le… --- ## [What are the best practices for data retention?](https://discuss.elastic.co/t/what-are-the-best-practices-for-data-retention/264858)
**Author:** [@lachezar.uzunov](https://discuss.elastic.co/u/lachezar.uzunov)\ **Replies:** 1\ **Last updated:** [February 22, 2021, 12:49am UTC](https://discuss.elastic.co/t/what-are-the-best-practices-for-data-retention/264858 "2021-02-22T00:49:42Z")
Hello, I am wondering what is the best practices for handling a big data indexes. For example if a firewall sends way too much logs to elastic stack, what is the best way to handle this situation? Is it possible to arch… --- ## [Cluster rebalancing parameters](https://discuss.elastic.co/t/cluster-rebalancing-parameters/264868)
**Author:** [@gorek](https://discuss.elastic.co/u/gorek)\ **Replies:** 1\ **Last updated:** [February 22, 2021, 12:47am UTC](https://discuss.elastic.co/t/cluster-rebalancing-parameters/264868 "2021-02-22T00:47:23Z")
Currently we have one-node-cluster. This node has high heap usage (from time to time we even see "circuit breaking exception") and high disk usage (currently over high disk watermark value) because it keep lots of indice… --- ## [Simple Search by field query](https://discuss.elastic.co/t/simple-search-by-field-query/264879)
**Author:** [@cis4life](https://discuss.elastic.co/u/cis4life)\ **Replies:** 0\ **Last updated:** [February 19, 2021, 3:53pm UTC](https://discuss.elastic.co/t/simple-search-by-field-query/264879 "2021-02-19T15:53:07Z")
I'm using the C# library to query a string in my cluster, but keep getting back results thats outside the string i want to search for. I basically want something on the lines of 'Select \* where field = 'some value' In … --- ## [Kibana has stopped](https://discuss.elastic.co/t/kibana-has-stopped/264882)
**Author:** [@Prabhath\_samarasingh](https://discuss.elastic.co/u/Prabhath_samarasingh)\ **Replies:** 1\ **Last updated:** [February 22, 2021, 12:44am UTC](https://discuss.elastic.co/t/kibana-has-stopped/264882 "2021-02-22T00:44:19Z")
Hi, I'm very new to elk and configured stack.Work fine. So I ship my syslog data to stack and now kibana stops. Stack run on Ubunto 20.04 AMD 64 server. cat /var/log/elasticsearch/elasticsearch.log \[2021-02-19T21:29… --- ## [Summing Timeseries](https://discuss.elastic.co/t/summing-timeseries/264883)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 1\ **Last updated:** [February 22, 2021, 12:42am UTC](https://discuss.elastic.co/t/summing-timeseries/264883 "2021-02-22T00:42:55Z")
Hi, How, in an aggregation, can I sum or do any other calculation across more than one timeseries? Thx D --- ## [ElasticSearch.NET query serialization](https://discuss.elastic.co/t/elasticsearch-net-query-serialization/264891)
**Author:** [@yongkeecho](https://discuss.elastic.co/u/yongkeecho)\ **Replies:** 0\ **Last updated:** [February 19, 2021, 5:02pm UTC](https://discuss.elastic.co/t/elasticsearch-net-query-serialization/264891 "2021-02-19T17:02:37Z")
Hi, I wonder if there is a public serializer or converter for QueryContainer object. var query = Query\.DateRange(r =\> r .Field(f =\> f.StartedOn) .GreaterThanOrEquals(new … --- ## [Kibana now supports ARM64, but ECK Kibana fails](https://discuss.elastic.co/t/kibana-now-supports-arm64-but-eck-kibana-fails/264904)
**Author:** [@simonpg](https://discuss.elastic.co/u/simonpg)\ **Replies:** 3\ **Last updated:** [February 22, 2021, 12:16am UTC](https://discuss.elastic.co/t/kibana-now-supports-arm64-but-eck-kibana-fails/264904 "2021-02-22T00:16:23Z")
I have elastic search running fine on my ARM64 five node k3s cluster. :smiley: I have moved on to kibana. The status of the kibana pod is Init:CrashLoopBackOff. :face\_with\_raised\_eyebrow: logging the elastic-internal-… --- ## [Kibana 7.11 Legacy GUI](https://discuss.elastic.co/t/kibana-7-11-legacy-gui/265009)
**Author:** [@lamp123432](https://discuss.elastic.co/u/lamp123432)\ **Replies:** 2\ **Last updated:** [February 21, 2021, 9:46pm UTC](https://discuss.elastic.co/t/kibana-7-11-legacy-gui/265009 "2021-02-21T21:46:53Z")
Any way to change the UI to Legacy in 7.11? I don't like the big black bar at the top, we embed Kibana in our client portal and now the clients see 3 bars, it's too much. --- ## [Why does it have duplicate ID with normal logstash output and fingerprint filter?](https://discuss.elastic.co/t/why-does-it-have-duplicate-id-with-normal-logstash-output-and-fingerprint-filter/264931)
**Author:** [@Bo\_Pham\_Nguyen](https://discuss.elastic.co/u/Bo_Pham_Nguyen)\ **Replies:** 1\ **Last updated:** [February 21, 2021, 9:47pm UTC](https://discuss.elastic.co/t/why-does-it-have-duplicate-id-with-normal-logstash-output-and-fingerprint-filter/264931 "2021-02-21T21:47:43Z")
Hi team, This is my logstash config to get data, and I use fingerprint as \_id in order to prevent duplication from data. But it still has duplicated event as below. Any help? filter { if \[type\] == "cve" { … --- ## [Elastic search using more RAM and not release](https://discuss.elastic.co/t/elastic-search-using-more-ram-and-not-release/264928)
**Author:** [@xgx](https://discuss.elastic.co/u/xgx)\ **Replies:** 1\ **Last updated:** [February 21, 2021, 9:45pm UTC](https://discuss.elastic.co/t/elastic-search-using-more-ram-and-not-release/264928 "2021-02-21T21:45:52Z")
Hi, I have a problem with elastic search uses a lot of os memory (non buff / cache).Here are some details： 1.I am using a 64 GB Ram machine . 2.I have allocated 26gb as ES heap size. 3.only elasticsearch service runn… --- ## [Can you export the data from a bar chart into a csv?](https://discuss.elastic.co/t/can-you-export-the-data-from-a-bar-chart-into-a-csv/265007)
**Author:** [@Amphagory](https://discuss.elastic.co/u/Amphagory)\ **Replies:** 1\ **Last updated:** [February 21, 2021, 9:44pm UTC](https://discuss.elastic.co/t/can-you-export-the-data-from-a-bar-chart-into-a-csv/265007 "2021-02-21T21:44:11Z")
Like tables visuals, I was hoping there would be a nice link in the bar chart visual to down the data to CSV. Any thought how I can download the data for a char chart? Ideally a link in the visual would be preferred. M… --- ## [Perform aggregation on small set of documents](https://discuss.elastic.co/t/perform-aggregation-on-small-set-of-documents/264515)
**Author:** [@Madhu\_Dasa](https://discuss.elastic.co/u/Madhu_Dasa)\ **Replies:** 3\ **Last updated:** [February 21, 2021, 9:26pm UTC](https://discuss.elastic.co/t/perform-aggregation-on-small-set-of-documents/264515 "2021-02-21T21:26:50Z")
I have a query which returns 100 documents. While performing aggregation it considers all the documents . But I want to apply aggregation only on top 5 documents. Is there a way to achieve this? --- ## [How to monitor inodes using metricbeat?](https://discuss.elastic.co/t/how-to-monitor-inodes-using-metricbeat/263818)
**Author:** [@premierpsp](https://discuss.elastic.co/u/premierpsp)\ **Replies:** 1\ **Last updated:** [February 21, 2021, 8:52pm UTC](https://discuss.elastic.co/t/how-to-monitor-inodes-using-metricbeat/263818 "2021-02-21T20:52:12Z")
Hi, is there any option to monitor linux inodes with metricbeat? Thank you --- ## [Data directory on remort serever](https://discuss.elastic.co/t/data-directory-on-remort-serever/264972)
**Author:** [@Ankur\_Mahajan](https://discuss.elastic.co/u/Ankur_Mahajan)\ **Replies:** 4\ **Last updated:** [February 21, 2021, 9:18pm UTC](https://discuss.elastic.co/t/data-directory-on-remort-serever/264972 "2021-02-21T21:18:53Z")
Is there any possibility where I can put the data directory to a remort cloud instance? Cloud instance 1 Public IP: 1:11:11:111 (Dummy) Elasticsearch data directory path: /home/elasticsearch/data Cloud instance 2 El… --- ## [Updated to 7.11.00 - Resource is under maintenance / recovery](https://discuss.elastic.co/t/updated-to-7-11-00-resource-is-under-maintenance-recovery/264782)
**Author:** [@austinsonger](https://discuss.elastic.co/u/austinsonger)\ **Replies:** 3\ **Last updated:** [February 21, 2021, 9:17pm UTC](https://discuss.elastic.co/t/updated-to-7-11-00-resource-is-under-maintenance-recovery/264782 "2021-02-21T21:17:52Z")
Upgraded to 7.11.0 and now have the following error {"ok":false,"message":"Resource is under maintenance / recovery."} --- ## [How can we add dynamic templates in existing elastic index](https://discuss.elastic.co/t/how-can-we-add-dynamic-templates-in-existing-elastic-index/264282)
**Author:** [@prakhara](https://discuss.elastic.co/u/prakhara)\ **Replies:** 5\ **Last updated:** [February 21, 2021, 9:16pm UTC](https://discuss.elastic.co/t/how-can-we-add-dynamic-templates-in-existing-elastic-index/264282 "2021-02-21T21:16:22Z")
I have a need to add more dynamic templates in my existing index mappings, how can I do that Tried doing below, but it didn't worked PUT {$indexname}\_mappings { "mappings" : { "dynamic\_templates" : \[ { "strings"… --- ## [Change analyzer into an existing index](https://discuss.elastic.co/t/change-analyzer-into-an-existing-index/264746)
**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Replies:** 3\ **Last updated:** [February 21, 2021, 9:15pm UTC](https://discuss.elastic.co/t/change-analyzer-into-an-existing-index/264746 "2021-02-21T21:15:05Z")
Hey there, I have an existing index without any custom setting or mapping for any field, so everything is by default. Into the docs I have a field named category which contains words like Women's or Womens. POST my\_in… --- ## [Case Sensitive Query for Text fields in Elasticsearch](https://discuss.elastic.co/t/case-sensitive-query-for-text-fields-in-elasticsearch/264015)
**Author:** [@pathfinder225](https://discuss.elastic.co/u/pathfinder225)\ **Replies:** 6\ **Last updated:** [February 21, 2021, 9:01pm UTC](https://discuss.elastic.co/t/case-sensitive-query-for-text-fields-in-elasticsearch/264015 "2021-02-21T21:01:44Z")
I have a requirement of case sensitive search where I need to search for particular word(case sensitive ) in message field which is of type text. I am using Java Rest High level client. My search word is ERROR , query… --- ## [Alerting creating](https://discuss.elastic.co/t/alerting-creating/261939)
**Author:** [@alfredo.deluca](https://discuss.elastic.co/u/alfredo.deluca)\ **Replies:** 3\ **Last updated:** [February 21, 2021, 8:27pm UTC](https://discuss.elastic.co/t/alerting-creating/261939 "2021-02-21T20:27:01Z")
Hi all. I am using for test purpose elastic on cloud and I'd like to create an alert/watcher (not sure which one is the best option) to send an alert when a POD on K8S goes down. That d be easy but I want to send the al… --- ## [AuditBeat and PacketBeat generated data size for elasticsearch sizing](https://discuss.elastic.co/t/auditbeat-and-packetbeat-generated-data-size-for-elasticsearch-sizing/265000)
**Author:** [@0x90](https://discuss.elastic.co/u/0x90)\ **Replies:** 1\ **Last updated:** [February 21, 2021, 8:22pm UTC](https://discuss.elastic.co/t/auditbeat-and-packetbeat-generated-data-size-for-elasticsearch-sizing/265000 "2021-02-21T20:22:25Z")
In order for me to plan my elasticsearch cluster volume size needs I calculated EPS and EDS values for filebeat , and winlogbeat by checking the number of lines in the logs. But I can't seem to find a way to calculate ho… --- ## [Hot warm architecture elasticsearch](https://discuss.elastic.co/t/hot-warm-architecture-elasticsearch/264935)
**Author:** [@testsemd\_email](https://discuss.elastic.co/u/testsemd_email)\ **Replies:** 5\ **Last updated:** [February 21, 2021, 6:49pm UTC](https://discuss.elastic.co/t/hot-warm-architecture-elasticsearch/264935 "2021-02-21T18:49:11Z")
Hi, I have 7 node cluster, master nodes - 3 hot nodes -2 warm nodes-2 An application creates daily indexes and sends indexes to a cluster. I want to use hot warm architecture for this cluster. I want to know how t… --- ## [Machine Lerning Tab giving error](https://discuss.elastic.co/t/machine-lerning-tab-giving-error/264990)
**Author:** [@Tombal](https://discuss.elastic.co/u/Tombal)\ **Replies:** 4\ **Last updated:** [February 21, 2021, 6:25pm UTC](https://discuss.elastic.co/t/machine-lerning-tab-giving-error/264990 "2021-02-21T18:25:29Z")
Hello, After i seperated my ml nodes, i realised my machine learning tab at kibana not working as expected. Probably it is about some other reason but couldn't find out how to fix this. I don't know whether something i… --- ## [New to Elastic/LogStash and have a few questions](https://discuss.elastic.co/t/new-to-elastic-logstash-and-have-a-few-questions/264322)
**Author:** [@Skatman](https://discuss.elastic.co/u/Skatman)\ **Replies:** 6\ **Last updated:** [February 21, 2021, 5:37pm UTC](https://discuss.elastic.co/t/new-to-elastic-logstash-and-have-a-few-questions/264322 "2021-02-21T17:37:44Z")
Hi all, Just started using Elastic Stack after hearing rave reviews from friends in the security industry. I used the free trial thing just to have a prod around the interface before setting my own instance up. Got a f… --- ## [Connection error to a secured Elasticsearch: unable to authenticate user](https://discuss.elastic.co/t/connection-error-to-a-secured-elasticsearch-unable-to-authenticate-user/264919)
**Author:** [@oferbar00](https://discuss.elastic.co/u/oferbar00)\ **Replies:** 4\ **Last updated:** [February 21, 2021, 4:07pm UTC](https://discuss.elastic.co/t/connection-error-to-a-secured-elasticsearch-unable-to-authenticate-user/264919 "2021-02-21T16:07:24Z")
Hello, I am trying to create a track from an Elasticsearch node (v7.5.2) that is running on a Windows server 2019 VM and using TLS with basic authentication. From the rally (v2.0.4) machine I am able to curl to it jus… [Previous page](https://discuss.elastic.co/latest.md?page=1825) [Next page](https://discuss.elastic.co/latest.md?page=1827)