# Latest **URL:** https://discuss.elastic.co/latest.md?page=1832 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1833 --- ## [Hardware recommendation about ES to avoid "Data too large"](https://discuss.elastic.co/t/hardware-recommendation-about-es-to-avoid-data-too-large/264643)
**Author:** [@jmliu1983](https://discuss.elastic.co/u/jmliu1983)\ **Replies:** 0\ **Last updated:** [February 18, 2021, 4:01am UTC](https://discuss.elastic.co/t/hardware-recommendation-about-es-to-avoid-data-too-large/264643 "2021-02-18T04:01:08Z")
I'm using ES in a machine which has 12G physical memory, when running lower size of data, everything is OK. But as long as the data size and document counts increasing, circuit breaker happens more and more frequently. … --- ## [Elasticsearch Topology Design](https://discuss.elastic.co/t/elasticsearch-topology-design/264638)
**Author:** [@InnerJoin](https://discuss.elastic.co/u/InnerJoin)\ **Replies:** 4\ **Last updated:** [February 18, 2021, 3:59am UTC](https://discuss.elastic.co/t/elasticsearch-topology-design/264638 "2021-02-18T03:59:50Z")
Hello Elasticsearch big-brain experts, I have been testing out Elasticsearch as a log vaulting, auditing tool, and SEIM for the last few months and my company has authorized the purchase of hardware to build a cluster. … --- ## [Mysql Processlist에서 Logstash의 커넥션이 사라지지 않습니다](https://discuss.elastic.co/t/mysql-processlist-logstash/257435)
**Author:** [@ohjinsol](https://discuss.elastic.co/u/ohjinsol)\ **Replies:** 1\ **Last updated:** [February 18, 2021, 2:59am UTC](https://discuss.elastic.co/t/mysql-processlist-logstash/257435 "2021-02-18T02:59:41Z")
안녕하세요 요번에 mysql데이터를 수집하는 logstash를 구성하였습니다. config파일에 input을 10가지로 구성하여 구성하였고 각 항목당 schedule 항목은 \* \* \* \* \*으로 구성하여 매분 데이터를 확인하고 가져올 수 있게 설정하였습니다. 데이터의 유입은 매분 있는것은 아니지만 이벤트가 발생하였을 때 마다 쌓이고 있습니다. 초반에 logstash를 실행시키면 m… --- ## [Empty server certificate chain does anybody know what to do i'm new to elastic? repeatedly getting these errors](https://discuss.elastic.co/t/empty-server-certificate-chain-does-anybody-know-what-to-do-im-new-to-elastic-repeatedly-getting-these-errors/264537)
**Author:** [@Jerin\_Joy](https://discuss.elastic.co/u/Jerin_Joy)\ **Replies:** 1\ **Last updated:** [February 18, 2021, 2:56am UTC](https://discuss.elastic.co/t/empty-server-certificate-chain-does-anybody-know-what-to-do-im-new-to-elastic-repeatedly-getting-these-errors/264537 "2021-02-18T02:56:47Z")
"stacktrace": \["io.netty.handler.codec.DecoderException: javax.net.ssl.SSLHandshakeException: Empty server certificate chain", "at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:471) ~\[… --- ## [데이터 분석 목적으로 활용](https://discuss.elastic.co/t/topic/263356)
**Author:** [@ycseol](https://discuss.elastic.co/u/ycseol)\ **Replies:** 1\ **Last updated:** [February 18, 2021, 2:46am UTC](https://discuss.elastic.co/t/topic/263356 "2021-02-18T02:46:09Z")
안녕하세요 데이버 분석 목적으로 Elasticsearch kibana 에서 1차 정제를 하려고 합니다. 1차 정제를 elastic kibana를 통해서 실시하고 정제된 데이터를 csv로 다운 받아서 데이터 분석가들이 분석을 하려고 합니다. 이럴 경우 비록 정제가 됐더라도 데이터가 많을 경우 메모리 오류가 날것 같은데 이런 경우 엘라스틱 을 잘못 활용한 케이스가 될까요? --- ## [Best visualization for showing single image from url formatted field?](https://discuss.elastic.co/t/best-visualization-for-showing-single-image-from-url-formatted-field/264502)
**Author:** [@Sjaak01](https://discuss.elastic.co/u/Sjaak01)\ **Replies:** 1\ **Last updated:** [February 18, 2021, 2:40am UTC](https://discuss.elastic.co/t/best-visualization-for-showing-single-image-from-url-formatted-field/264502 "2021-02-18T02:40:28Z")
Hi, I'm using a scripted field formatted as a url to display some images. This works surprisingly well except outside of discovery the only visualization I seem to be able to use with this field is the table visualizati… --- ## [Filebeat - 7.10.2 - Flooding Syslog with CIFS Errors](https://discuss.elastic.co/t/filebeat-7-10-2-flooding-syslog-with-cifs-errors/263587)
**Author:** [@scott\_stash](https://discuss.elastic.co/u/scott_stash)\ **Replies:** 6\ **Last updated:** [February 18, 2021, 2:27am UTC](https://discuss.elastic.co/t/filebeat-7-10-2-flooding-syslog-with-cifs-errors/263587 "2021-02-18T02:27:19Z")
Previously I was running Filebeat 7.5 on Ubuntu 18.04. I have installed Filebeat 7.10.2 on Ubuntu 20, and now my syslog is flooded with this message while filebeat is running: CIFS VFS: Close unmatched open The config… --- ## [Working with wildcards](https://discuss.elastic.co/t/working-with-wildcards/264583)
**Author:** [@Alexandros888](https://discuss.elastic.co/u/Alexandros888)\ **Replies:** 1\ **Last updated:** [February 18, 2021, 2:15am UTC](https://discuss.elastic.co/t/working-with-wildcards/264583 "2021-02-18T02:15:13Z")
Hello, When i search in kibana with the following expression: message: ".pdf' to SFTP rejected folder (/in/ORDERS/.rejected)" I get successfully the results that i want (see image 1) image 1 But, when i search in… --- ## [Filebeat Cisco Umbrella Fileset](https://discuss.elastic.co/t/filebeat-cisco-umbrella-fileset/262731)
**Author:** [@InnerJoin](https://discuss.elastic.co/u/InnerJoin)\ **Replies:** 6\ **Last updated:** [February 18, 2021, 1:36am UTC](https://discuss.elastic.co/t/filebeat-cisco-umbrella-fileset/262731 "2021-02-18T01:36:05Z")
Hi. I'm trying to set up the Filebeat Cisco module with the Umbrella fileset. I understand that they do not yet support Cisco managed S3 instances but I see that you can set the input to be file. I can't find anything ab… --- ## [Issues with Elasticsearch Scroll API results](https://discuss.elastic.co/t/issues-with-elasticsearch-scroll-api-results/264581)
**Author:** [@samacker77elastic](https://discuss.elastic.co/u/samacker77elastic)\ **Replies:** 0\ **Last updated:** [February 17, 2021, 1:30pm UTC](https://discuss.elastic.co/t/issues-with-elasticsearch-scroll-api-results/264581 "2021-02-17T13:30:30Z")
Hi everyone, I am trying to read documents from an index using the scroll API. The problem that I am facing is that, Kibana Discover shows the hits to be 195,867, but my code misses or skips 10,000 documents. I am not… --- ## [Issues filtering Elasticsearch logs in Docker with Modules](https://discuss.elastic.co/t/issues-filtering-elasticsearch-logs-in-docker-with-modules/263314)
**Author:** [@leosunmo](https://discuss.elastic.co/u/leosunmo)\ **Replies:** 1\ **Last updated:** [February 18, 2021, 12:02am UTC](https://discuss.elastic.co/t/issues-filtering-elasticsearch-logs-in-docker-with-modules/263314 "2021-02-18T00:02:54Z")
Hey there, I'm running in to some matching issues when I'm trying to use the Elasticsearch Module with the Docker provider. I've followed this blog post on how to make it play nicely together somewhat. My issue is tha… --- ## [Why word\_delimiter doesn's work on my index?](https://discuss.elastic.co/t/why-word-delimiter-doesns-work-on-my-index/264624)
**Author:** [@andymov](https://discuss.elastic.co/u/andymov)\ **Replies:** 4\ **Last updated:** [February 17, 2021, 11:28pm UTC](https://discuss.elastic.co/t/why-word-delimiter-doesns-work-on-my-index/264624 "2021-02-17T23:28:21Z")
Hi all! I need to search my products by codes like this one: "50-14Lx". I use word\_delimiter to tokenize "50-14Lx" to "50","14","Lx". But it doesn't work on my index. Index: PUT /products { "settings": {… --- ## [Where is watcher?](https://discuss.elastic.co/t/where-is-watcher/264627)
**Author:** [@A\_Chichi](https://discuss.elastic.co/u/A_Chichi)\ **Replies:** 2\ **Last updated:** [February 17, 2021, 11:05pm UTC](https://discuss.elastic.co/t/where-is-watcher/264627 "2021-02-17T23:05:30Z")
Hello, I would like to add alert to my ES cluster (v7.11). I have the basic licence, so normally I have access to "Watcher" feature. I've checked this link : https://www.elastic.co/guide/en/kibana/current/watcher-ui.h… --- ## [Kibana Elasticsearch TLS does not work (alert and actions)](https://discuss.elastic.co/t/kibana-elasticsearch-tls-does-not-work-alert-and-actions/264367)
**Author:** [@swood](https://discuss.elastic.co/u/swood)\ **Replies:** 1\ **Last updated:** [February 17, 2021, 10:16pm UTC](https://discuss.elastic.co/t/kibana-elasticsearch-tls-does-not-work-alert-and-actions/264367 "2021-02-17T22:16:02Z")
Hi, I have the same problem as someone had by the topic: Does it possible to investigate the reason why it doesn't work? Maybe some checklist or to run some command to identify which of the instruction point I don't im… --- ## [Elastic Cloud : Searchable snapshots requirements and howto?](https://discuss.elastic.co/t/elastic-cloud-searchable-snapshots-requirements-and-howto/264258)
**Author:** [@hilt86](https://discuss.elastic.co/u/hilt86)\ **Replies:** 3\ **Last updated:** [February 17, 2021, 10:14pm UTC](https://discuss.elastic.co/t/elastic-cloud-searchable-snapshots-requirements-and-howto/264258 "2021-02-17T22:14:00Z")
Hi Folks, I've been trying to get searchable snapshots working on 7.11 and have tried the setting the cold phase to take a searchable snapshot (using the found-snapshots repo - this might be a mistake) but the actions n… --- ## [Kibana Fails due to Depreciation Warning](https://discuss.elastic.co/t/kibana-fails-due-to-depreciation-warning/264413)
**Author:** [@Gosborne](https://discuss.elastic.co/u/Gosborne)\ **Replies:** 2\ **Last updated:** [February 17, 2021, 9:47pm UTC](https://discuss.elastic.co/t/kibana-fails-due-to-depreciation-warning/264413 "2021-02-17T21:47:15Z")
I have installed kibana following the elastic guide and configured it to point to my two elastic node via elasticsearch.hosts: \["https://xx.xx.xx.xx:9200","https://xx.xx.xx.xx:9200"\]. The only other settings i've changed… --- ## [Is it wise to freeze rolled over index even though it will be heavily searched?](https://discuss.elastic.co/t/is-it-wise-to-freeze-rolled-over-index-even-though-it-will-be-heavily-searched/264050)
**Author:** [@linkerc](https://discuss.elastic.co/u/linkerc)\ **Replies:** 6\ **Last updated:** [February 17, 2021, 9:23pm UTC](https://discuss.elastic.co/t/is-it-wise-to-freeze-rolled-over-index-even-though-it-will-be-heavily-searched/264050 "2021-02-17T21:23:31Z")
As the title stated. Since the queue size for frozen index is smaller, does it impact search significantly? We rolled over index that stores events as they come in. The roll over criterion is based on shard size. We … --- ## [Filebeat on ECK with AWS Module Fails Due To Metadata Error](https://discuss.elastic.co/t/filebeat-on-eck-with-aws-module-fails-due-to-metadata-error/264616)
**Author:** [@jgriffiths](https://discuss.elastic.co/u/jgriffiths)\ **Replies:** 0\ **Last updated:** [February 17, 2021, 9:21pm UTC](https://discuss.elastic.co/t/filebeat-on-eck-with-aws-module-fails-due-to-metadata-error/264616 "2021-02-17T21:21:41Z")
We are running an Elastic Stack with ECK in EKS (7.8). We noticed that our filebeat daemonset and the AWS module were not processing logs from S3 and our SQS queues backing up. Looking at the logs on our FileBeat conta… --- ## [How is search.max\_buckets calculated? ES 7.5.0](https://discuss.elastic.co/t/how-is-search-max-buckets-calculated-es-7-5-0/264610)
**Author:** [@JonathanAaron](https://discuss.elastic.co/u/JonathanAaron)\ **Replies:** 2\ **Last updated:** [February 17, 2021, 9:11pm UTC](https://discuss.elastic.co/t/how-is-search-max-buckets-calculated-es-7-5-0/264610 "2021-02-17T21:11:57Z")
I'm wondering how search.max\_buckets is calculated. I have a multilevel terms aggregation. We have 10,000 leaf node buckets. Do the parent buckets count as part of the 10,000 limit? --- ## [Machine learning permissions failure \[Kibana Security Menu\]](https://discuss.elastic.co/t/machine-learning-permissions-failure-kibana-security-menu/264475)
**Author:** [@francescouk](https://discuss.elastic.co/u/francescouk)\ **Replies:** 3\ **Last updated:** [February 17, 2021, 8:44pm UTC](https://discuss.elastic.co/t/machine-learning-permissions-failure-kibana-security-menu/264475 "2021-02-17T20:44:51Z")
Hi there, Clean install using apt repo and as soon as I try to access the security overview, it display this message: Machine learning permissions failure Not Found HttpFetchError@https://192.168.0.1:5601/37897/bundle… --- ## [Encryption for hosted Elasticsearch instance](https://discuss.elastic.co/t/encryption-for-hosted-elasticsearch-instance/264604)
**Author:** [@christhegrand](https://discuss.elastic.co/u/christhegrand)\ **Replies:** 1\ **Last updated:** [February 17, 2021, 8:27pm UTC](https://discuss.elastic.co/t/encryption-for-hosted-elasticsearch-instance/264604 "2021-02-17T20:27:46Z")
Do hosted Elasticsearch instances provide encryption at rest? --- ## [High disk usage while docker container is recreating](https://discuss.elastic.co/t/high-disk-usage-while-docker-container-is-recreating/264533)
**Author:** [@homa\_inc](https://discuss.elastic.co/u/homa_inc)\ **Replies:** 1\ **Last updated:** [February 17, 2021, 7:29pm UTC](https://discuss.elastic.co/t/high-disk-usage-while-docker-container-is-recreating/264533 "2021-02-17T19:29:09Z")
Hi there. I have Filebeat container that configured to scan redis logs from redis container. There is configuration (filebeat.yml): filebeat.registry.flush: 2s output.elasticsearch: hosts: \['${ELASTICSEARCH\_HOST… --- ## [Metricbeat getResources failed AccessDeniedException](https://discuss.elastic.co/t/metricbeat-getresources-failed-accessdeniedexception/264556)
**Author:** [@atharvak](https://discuss.elastic.co/u/atharvak)\ **Replies:** 1\ **Last updated:** [February 17, 2021, 7:21pm UTC](https://discuss.elastic.co/t/metricbeat-getresources-failed-accessdeniedexception/264556 "2021-02-17T19:21:14Z")
Hello guys, I am trying to setup Metricbeat for my AWS account. I have already created an IAM user with full access to EC2, S3, Cloudwatch, etc. Following is my configuration #- module: aws # period: 1m # metricsets:… --- ## [ElasticSearch on Docker Swarm using host network](https://discuss.elastic.co/t/elasticsearch-on-docker-swarm-using-host-network/264606)
**Author:** [@Nuno\_Centeio](https://discuss.elastic.co/u/Nuno_Centeio)\ **Replies:** 0\ **Last updated:** [February 17, 2021, 6:46pm UTC](https://discuss.elastic.co/t/elasticsearch-on-docker-swarm-using-host-network/264606 "2021-02-17T18:46:51Z")
I'm trying to build a 3 node (1 master + 2 nodes) Docker Swarm using Azure's Ubuntu image. I've then tried to deploy an ElasticSearch 3 node cluster. This is my YAML file: version: '3.7' services: elasticsearch: … --- ## [.NET core app unsuccessful transfer to APM server on Kubernetes](https://discuss.elastic.co/t/net-core-app-unsuccessful-transfer-to-apm-server-on-kubernetes/264242)
**Author:** [@greenfield](https://discuss.elastic.co/u/greenfield)\ **Replies:** 3\ **Last updated:** [February 17, 2021, 6:41pm UTC](https://discuss.elastic.co/t/net-core-app-unsuccessful-transfer-to-apm-server-on-kubernetes/264242 "2021-02-17T18:41:52Z")
Kibana version: 7.11 Elasticsearch version: 7.11 APM Server version: 7.11 APM Agent language and version: .NET\_Core/3.1.12 Original install method (e.g. download page, yum, deb, from source, etc.) and version: ECK o… --- ## [Watch Execution simulation not returning results](https://discuss.elastic.co/t/watch-execution-simulation-not-returning-results/264553)
**Author:** [@Saugat\_Mukherjee](https://discuss.elastic.co/u/Saugat_Mukherjee)\ **Replies:** 2\ **Last updated:** [February 17, 2021, 6:18pm UTC](https://discuss.elastic.co/t/watch-execution-simulation-not-returning-results/264553 "2021-02-17T18:18:47Z")
Hi, I am trying to simulate a watch and see if the actions are triggering fine. But my problem is the search returns no results. My query Checks for a particular index. Checks for a range Check for the servicename fi… --- ## [Audit Watchers](https://discuss.elastic.co/t/audit-watchers/264436)
**Author:** [@bmbrit](https://discuss.elastic.co/u/bmbrit)\ **Replies:** 3\ **Last updated:** [February 17, 2021, 5:36pm UTC](https://discuss.elastic.co/t/audit-watchers/264436 "2021-02-17T17:36:13Z")
Hi, Is it possible to audit the watcher changes? We want to monitor who modifies the watcher and would like to audit this information. Since we as a team have got access(admin) to the Watcher, the watcher is getting m… --- ## [Parse Error json object](https://discuss.elastic.co/t/parse-error-json-object/264534)
**Author:** [@ljeganathan](https://discuss.elastic.co/u/ljeganathan)\ **Replies:** 1\ **Last updated:** [February 17, 2021, 5:05pm UTC](https://discuss.elastic.co/t/parse-error-json-object/264534 "2021-02-17T17:05:47Z")
Hi, I am getting parse error like below JSON parse error, original data now in message field {:error=\>#\ **Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 1\ **Last updated:** [February 17, 2021, 4:13pm UTC](https://discuss.elastic.co/t/kibana-on-arm/264587 "2021-02-17T16:13:47Z") Hi, Can you give any indication of when an ARM based kibana package will become available? Thx D --- ## [Kibana bin folder contains large number of core files 7.2.0](https://discuss.elastic.co/t/kibana-bin-folder-contains-large-number-of-core-files-7-2-0/264403)
**Author:** [@gora](https://discuss.elastic.co/u/gora)\ **Replies:** 2\ **Last updated:** [February 17, 2021, 4:08pm UTC](https://discuss.elastic.co/t/kibana-bin-folder-contains-large-number-of-core-files-7-2-0/264403 "2021-02-17T16:08:37Z")
Hi Team, Getting this error in kibana startup.log "pid":123452,"message":"You should set server.basePath along with server.rewriteBasePath. Starting in 7.0, Kibana will expect that all requests start with server.basePa… [Previous page](https://discuss.elastic.co/latest.md?page=1831) [Next page](https://discuss.elastic.co/latest.md?page=1833)