# Latest **URL:** https://discuss.elastic.co/latest.md?page=1859 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1860 --- ## [Index Status goes Unknown after Dramatic Increase in Size](https://discuss.elastic.co/t/index-status-goes-unknown-after-dramatic-increase-in-size/263038)
**Author:** [@Senthamarai\_Kannan](https://discuss.elastic.co/u/Senthamarai_Kannan)\ **Replies:** 2\ **Last updated:** [February 3, 2021, 1:22pm UTC](https://discuss.elastic.co/t/index-status-goes-unknown-after-dramatic-increase-in-size/263038 "2021-02-03T13:22:35Z")
One of our ES indices go to Unknown status after the size increases dramatically. Usually the index size is about 300MB but it goes above 8GB and goes to Unknown state. This is a single node instance hosted in a Windo… --- ## [Incorrect regexp reaction](https://discuss.elastic.co/t/incorrect-regexp-reaction/263001)
**Author:** [@dmalchikov](https://discuss.elastic.co/u/dmalchikov)\ **Replies:** 3\ **Last updated:** [February 3, 2021, 1:17pm UTC](https://discuss.elastic.co/t/incorrect-regexp-reaction/263001 "2021-02-03T13:17:07Z")
Hi! Using ELK 7.10 Tried different terms but result always go through My winlogbeat.yml: ...... '- name: Windows PowerShell event\_id: 400, 403, 600, 800 processors: - drop\_event.when.or: - regexp.process.command\_l… --- ## [Better way to convert the object field to nested type field](https://discuss.elastic.co/t/better-way-to-convert-the-object-field-to-nested-type-field/263026)
**Author:** [@Prabaharan\_Kathiresa](https://discuss.elastic.co/u/Prabaharan_Kathiresa)\ **Replies:** 0\ **Last updated:** [February 2, 2021, 6:14pm UTC](https://discuss.elastic.co/t/better-way-to-convert-the-object-field-to-nested-type-field/263026 "2021-02-02T18:14:08Z")
Hi Team We have an index with object field, we are planning to improve the object field into nested type (array of objects). ie. { "name": "Adam", "car" : { "name": "Maruthi", "modelyear": "2005" } } we are … --- ## [Parallel queries to partitions in Elasticsearch aggregations](https://discuss.elastic.co/t/parallel-queries-to-partitions-in-elasticsearch-aggregations/263122)
**Author:** [@NerdSec](https://discuss.elastic.co/u/NerdSec)\ **Replies:** 0\ **Last updated:** [February 3, 2021, 12:58pm UTC](https://discuss.elastic.co/t/parallel-queries-to-partitions-in-elasticsearch-aggregations/263122 "2021-02-03T12:58:40Z")
If I have a partitioned terms aggregation, say with 20 partitions. If I request for all the 20 partitions by sending 20 requests at the same time using the REST API, will the result be fetched faster or would it still ta… --- ## [Filebeat o365 module - Parsing o365.audit.data field](https://discuss.elastic.co/t/filebeat-o365-module-parsing-o365-audit-data-field/261591)
**Author:** [@opiedrah](https://discuss.elastic.co/u/opiedrah)\ **Replies:** 4\ **Last updated:** [February 3, 2021, 12:24pm UTC](https://discuss.elastic.co/t/filebeat-o365-module-parsing-o365-audit-data-field/261591 "2021-02-03T12:24:52Z")
Hi, I have filebeat 7.10 running with module o365 beat. Similar to how extendedproperties filed for azure active directory workload is parsed. How can i parse this o365.audit.data filed. the value in this field looks… --- ## [Percentage symbol in vega bar graphs](https://discuss.elastic.co/t/percentage-symbol-in-vega-bar-graphs/262794)
**Author:** [@Pranusha119](https://discuss.elastic.co/u/Pranusha119)\ **Replies:** 2\ **Last updated:** [February 3, 2021, 12:05pm UTC](https://discuss.elastic.co/t/percentage-symbol-in-vega-bar-graphs/262794 "2021-02-03T12:05:01Z")
{ "$schema": "https://vega.github.io/schema/vega-lite/v4.json", "description": "A bar graph showing what activites consume what percentage of the day.", "data": { "values": \[ {"Activity": "Sleeping", "Tim… --- ## [Logstash errors](https://discuss.elastic.co/t/logstash-errors/263116)
**Author:** [@vdelcampo](https://discuss.elastic.co/u/vdelcampo)\ **Replies:** 0\ **Last updated:** [February 3, 2021, 12:02pm UTC](https://discuss.elastic.co/t/logstash-errors/263116 "2021-02-03T12:02:08Z")
Hi! Since last week Im having a lot of errors in logstash like these: \[ERROR\] 2021-02-03 11:59:46.340 \[nioEventLoopGroup-2-1\] tcp - Error in Netty pipeline: java.io.IOException: Connection reset by peer \[ERROR\] 2021-0… --- ## [ML job - detect new port](https://discuss.elastic.co/t/ml-job-detect-new-port/263107)
**Author:** [@probson](https://discuss.elastic.co/u/probson)\ **Replies:** 2\ **Last updated:** [February 3, 2021, 11:58am UTC](https://discuss.elastic.co/t/ml-job-detect-new-port/263107 "2021-02-03T11:58:39Z")
Hi, I am sending vulnerability scan results into the SIEM and trying to detect new ports scanned for an assest. Ive tried using Rare, by field: port and partition: asset but the results are coming back empty. It could… --- ## [No\_shard\_available\_action\_exception in integration tests](https://discuss.elastic.co/t/no-shard-available-action-exception-in-integration-tests/262941)
**Author:** [@rdehuyss](https://discuss.elastic.co/u/rdehuyss)\ **Replies:** 4\ **Last updated:** [February 3, 2021, 11:49am UTC](https://discuss.elastic.co/t/no-shard-available-action-exception-in-integration-tests/262941 "2021-02-03T11:49:34Z")
Hi, I'm the author of JobRunr, a distributed job scheduling library that also supports ElasticSearch as a storage provider. For my integration tests, I use TestContainers and start an ElasticSearch. @Container pri… --- ## [Pushing different types of (access, application) logs using filebeat-daemonset in Kubernetes](https://discuss.elastic.co/t/pushing-different-types-of-access-application-logs-using-filebeat-daemonset-in-kubernetes/261353)
**Author:** [@JasminShah](https://discuss.elastic.co/u/JasminShah)\ **Replies:** 2\ **Last updated:** [February 3, 2021, 11:43am UTC](https://discuss.elastic.co/t/pushing-different-types-of-access-application-logs-using-filebeat-daemonset-in-kubernetes/261353 "2021-02-03T11:43:54Z")
I have several pods running spring-boot applications, writing application-logs to stdout, which is then picked up by filebeat-daemonset and then pushed to elasticsearch. (standard logging architecture for kubernetes) No… --- ## [Logstash error. Expected symbols](https://discuss.elastic.co/t/logstash-error-expected-symbols/262752)
**Author:** [@111435](https://discuss.elastic.co/u/111435)\ **Replies:** 5\ **Last updated:** [February 3, 2021, 11:38am UTC](https://discuss.elastic.co/t/logstash-error-expected-symbols/262752 "2021-02-03T11:38:34Z")
Hello, I am new at logstash, so please could you help me. I have this log: 2021-01-27 00:20:10 GET /ads/servlet/dbRequest?BNumber=353&ANumber=485739274 200 0.013 There are tabs between "date", "time", "GET" and "… --- ## [@timestamp in date\_nanos](https://discuss.elastic.co/t/timestamp-in-date-nanos/263112)
**Author:** [@ritusingh](https://discuss.elastic.co/u/ritusingh)\ **Replies:** 0\ **Last updated:** [February 3, 2021, 11:17am UTC](https://discuss.elastic.co/t/timestamp-in-date-nanos/263112 "2021-02-03T11:17:19Z")
Hi , I am using ELK 7.7.0 and want to know that how can I change @timestamp to date\_nanos while sending logs from logstash to elasticsearch? I know that we can change format of @timestamp to date\_nanos , but it simply … --- ## [Synonyms multi word search issue](https://discuss.elastic.co/t/synonyms-multi-word-search-issue/263110)
**Author:** [@smshabab11](https://discuss.elastic.co/u/smshabab11)\ **Replies:** 0\ **Last updated:** [February 3, 2021, 11:09am UTC](https://discuss.elastic.co/t/synonyms-multi-word-search-issue/263110 "2021-02-03T11:09:47Z")
I have created an index with synonyms.txt file in which there is a word GDM and corresponding synonym is General Data Manager and the expectation is If I want to search "GDM" it should show results which has "GDM" or "Ge… --- ## [In ECK - Verify that a coordinating-only node is doing its job](https://discuss.elastic.co/t/in-eck-verify-that-a-coordinating-only-node-is-doing-its-job/261859)
**Author:** [@sbonami](https://discuss.elastic.co/u/sbonami)\ **Replies:** 6\ **Last updated:** [February 3, 2021, 11:04am UTC](https://discuss.elastic.co/t/in-eck-verify-that-a-coordinating-only-node-is-doing-its-job/261859 "2021-02-03T11:04:33Z")
Hi, I'm using Elastic Cloud on Kubernetes (version 1.1.2 according to the operator). I want to have a coordinating-only node in my cluster. For the config, I have set node.master, node.data, node.ingest, node.ml, node.tr… --- ## [Integrating Ingest Pipeline with the Indicies](https://discuss.elastic.co/t/integrating-ingest-pipeline-with-the-indicies/263106)
**Author:** [@shiv97](https://discuss.elastic.co/u/shiv97)\ **Replies:** 0\ **Last updated:** [February 3, 2021, 10:43am UTC](https://discuss.elastic.co/t/integrating-ingest-pipeline-with-the-indicies/263106 "2021-02-03T10:43:34Z")
Hi Everyone, I have created one ingest pipeline now I want to attach this pipeline with the index having the format "cwl-2021.02.02 " where indices from every date are created like "cwl-2021.02.03" and so on... So I tr… --- ## [Circuit\_breaking\_exception](https://discuss.elastic.co/t/circuit-breaking-exception/261503)
**Author:** [@zen.xen](https://discuss.elastic.co/u/zen.xen)\ **Replies:** 12\ **Last updated:** [February 3, 2021, 10:37am UTC](https://discuss.elastic.co/t/circuit-breaking-exception/261503 "2021-02-03T10:37:24Z")
@Marta\_Bondyra Hello, I need some help { "error": { "root\_cause": \[ { "type": "circuit\_breaking\_exception", "reason": "\[parent\] Data too large, data for \[\ \[host\] error in ElasticSearch](https://discuss.elastic.co/t/syslog-pipeline-host-error-in-elasticsearch/262657)
**Author:** [@expressionlibre](https://discuss.elastic.co/u/expressionlibre)\ **Replies:** 11\ **Last updated:** [February 3, 2021, 10:32am UTC](https://discuss.elastic.co/t/syslog-pipeline-host-error-in-elasticsearch/262657 "2021-02-03T10:32:07Z")
Hi, Sorry may be a newbie question but, I read lots of treads and examples on the net to setup syslog pipeline but I still cannot make my logstash pipeline to function in ES. platform : CentOS 8.3. Epel versions for … --- ## [Packetbeat handle error when exec show databases](https://discuss.elastic.co/t/packetbeat-handle-error-when-exec-show-databases/262469)
**Author:** [@282857484](https://discuss.elastic.co/u/282857484)\ **Replies:** 3\ **Last updated:** [February 3, 2021, 10:28am UTC](https://discuss.elastic.co/t/packetbeat-handle-error-when-exec-show-databases/262469 "2021-02-03T10:28:22Z")
Version: master(newest) Operating System: macos 11.1 Steps to Reproduce: env:mysql5.7,mysql8.0 packetbeat when exec "show databases" then the program will never recovery. because the var complete return false,and… --- ## [Rest API for last 30 days data from elasticsearch](https://discuss.elastic.co/t/rest-api-for-last-30-days-data-from-elasticsearch/262877)
**Author:** [@Gauti](https://discuss.elastic.co/u/Gauti)\ **Replies:** 5\ **Last updated:** [February 3, 2021, 10:10am UTC](https://discuss.elastic.co/t/rest-api-for-last-30-days-data-from-elasticsearch/262877 "2021-02-03T10:10:17Z")
Hi All, I am trying to export data from elasticsearch using rest api below is an example which got succeeded, but this will give complete data present in index URL : http://dashboard.iff.com:9200/inctable/\_search/ H… --- ## [MetricBeat error](https://discuss.elastic.co/t/metricbeat-error/262153)
**Author:** [@cloudenv](https://discuss.elastic.co/u/cloudenv)\ **Replies:** 7\ **Last updated:** [January 28, 2021, 3:52pm UTC](https://discuss.elastic.co/t/metricbeat-error/262153 "2021-01-28T15:52:46Z")
Ok will try to be civil here, but 'd be hard as Im furious. Have spent all f\* day tryting to setup Kibana ( cloud / self ) Am trying to configure metricbeat using this. Im getting Anyone? PS: why all texts here are… --- ## [Using esrally to measure painless script partial update performance](https://discuss.elastic.co/t/using-esrally-to-measure-painless-script-partial-update-performance/262263)
**Author:** [@dineshabbi](https://discuss.elastic.co/u/dineshabbi)\ **Replies:** 6\ **Last updated:** [February 3, 2021, 9:42am UTC](https://discuss.elastic.co/t/using-esrally-to-measure-painless-script-partial-update-performance/262263 "2021-02-03T09:42:02Z")
Hi team, I am trying to measure bulk partial update performance. I am wondering if its possible to do this via esrally at all. For eg, our application uses painless scripts for partial update and the target for these u… --- ## [One of master pod is not getting restarted](https://discuss.elastic.co/t/one-of-master-pod-is-not-getting-restarted/262985)
**Author:** [@knagasri](https://discuss.elastic.co/u/knagasri)\ **Replies:** 3\ **Last updated:** [February 3, 2021, 9:04am UTC](https://discuss.elastic.co/t/one-of-master-pod-is-not-getting-restarted/262985 "2021-02-03T09:04:35Z")
I have deployed ECK 1.3.0 in GCP with 2 master and 3 data-ingest nodes. For backup purpose, referenced secret in secure settings in elasticsearch file and re applied. All the data-ingest and one of master pods are restar… --- ## [Metricbeat dosen't collect CPU and Memory if Load is enabled in windows machines](https://discuss.elastic.co/t/metricbeat-dosent-collect-cpu-and-memory-if-load-is-enabled-in-windows-machines/262802)
**Author:** [@Sathish22](https://discuss.elastic.co/u/Sathish22)\ **Replies:** 1\ **Last updated:** [February 3, 2021, 8:58am UTC](https://discuss.elastic.co/t/metricbeat-dosent-collect-cpu-and-memory-if-load-is-enabled-in-windows-machines/262802 "2021-02-03T08:58:14Z")
Hi Team, I have installed metricbeat in windows machine If we disable Load from the system.yml file we can able to capture CPU and Memory metrics but after enabling load we didn't get data for CPU, Memory, and Load Bu… --- ## [Does ECK 1.3.0 supports workload identity](https://discuss.elastic.co/t/does-eck-1-3-0-supports-workload-identity/263021)
**Author:** [@knagasri](https://discuss.elastic.co/u/knagasri)\ **Replies:** 1\ **Last updated:** [February 3, 2021, 8:56am UTC](https://discuss.elastic.co/t/does-eck-1-3-0-supports-workload-identity/263021 "2021-02-03T08:56:10Z")
For ECK 1.3.0 , does operator supports workload identity feature instead of creating k8s secrets(service account credentials JSON file which has storage admin permissions for that GCS bucket) manually for easticsearch … --- ## [APM Agent is not working on FIPS enabled java application](https://discuss.elastic.co/t/apm-agent-is-not-working-on-fips-enabled-java-application/261815)
**Author:** [@Dhanaraju\_Vasireddy](https://discuss.elastic.co/u/Dhanaraju_Vasireddy)\ **Replies:** 18\ **Last updated:** [February 3, 2021, 8:42am UTC](https://discuss.elastic.co/t/apm-agent-is-not-working-on-fips-enabled-java-application/261815 "2021-02-03T08:42:45Z")
Hi We are trying to using APM agent in an application which is FIPS complaint and using CCJ jar (security.provider.5=com.sun.net.ssl.internal.ssl.Provider CCJ) Problem1: In the Java APM agent, below line keeps failing … --- ## [7.10 RestHighLevelClient - Composable Index Template and Component Template APIs difficult to use](https://discuss.elastic.co/t/7-10-resthighlevelclient-composable-index-template-and-component-template-apis-difficult-to-use/263097)
**Author:** [@Rajath\_H\_G](https://discuss.elastic.co/u/Rajath_H_G)\ **Replies:** 0\ **Last updated:** [February 3, 2021, 8:41am UTC](https://discuss.elastic.co/t/7-10-resthighlevelclient-composable-index-template-and-component-template-apis-difficult-to-use/263097 "2021-02-03T08:41:47Z")
I am planning to migrate from legacy templates to Composable Templates introduced in 7.x. But with Composable Templates we don't have APIs to feed complete template request string directly or build one using XContentBui… --- ## [An we add log retentions for elasticsearch, logstash, kibana and metric beat](https://discuss.elastic.co/t/an-we-add-log-retentions-for-elasticsearch-logstash-kibana-and-metric-beat/263096)
**Author:** [@Somesh\_ng](https://discuss.elastic.co/u/Somesh_ng)\ **Replies:** 0\ **Last updated:** [February 3, 2021, 8:37am UTC](https://discuss.elastic.co/t/an-we-add-log-retentions-for-elasticsearch-logstash-kibana-and-metric-beat/263096 "2021-02-03T08:37:59Z")
Can we add log retentions for elasticsearch, logstash, kibana and metric beat like below in .yml file logging.level: debug logging.to\_files: true logging.to\_syslog: false logging.files: path: /log… --- ## [Error while indexing data to App Search using Logstash](https://discuss.elastic.co/t/error-while-indexing-data-to-app-search-using-logstash/263094)
**Author:** [@sanju1323](https://discuss.elastic.co/u/sanju1323)\ **Replies:** 0\ **Last updated:** [February 3, 2021, 8:34am UTC](https://discuss.elastic.co/t/error-while-indexing-data-to-app-search-using-logstash/263094 "2021-02-03T08:34:19Z")
Hi Team, I have been trying to index the data from local Elasticsearch cluster to App Search engine using logstash. But I'm getting the below error. Copy to clipboard \[2021-02-01T13:45:30,097\]\[DEBUG\]\[logstash.javapipe… --- ## [\[400\] Filters cannot have more than 32 filters](https://discuss.elastic.co/t/400-filters-cannot-have-more-than-32-filters/263091)
**Author:** [@Swapnil\_Ghorpade](https://discuss.elastic.co/u/Swapnil_Ghorpade)\ **Replies:** 1\ **Last updated:** [February 3, 2021, 8:24am UTC](https://discuss.elastic.co/t/400-filters-cannot-have-more-than-32-filters/263091 "2021-02-03T08:24:34Z")
Error : An unexpected error occurred: \[400\] Filters cannot have more than 32 filters Im trying to filter out documents using none filter. The search api return data properly on passing array upto 32 filters. but for mo… --- ## [Connection refused logstash to elasticsearch](https://discuss.elastic.co/t/connection-refused-logstash-to-elasticsearch/262970)
**Author:** [@vikram\_singh](https://discuss.elastic.co/u/vikram_singh)\ **Replies:** 8\ **Last updated:** [February 3, 2021, 8:17am UTC](https://discuss.elastic.co/t/connection-refused-logstash-to-elasticsearch/262970 "2021-02-03T08:17:20Z")
Hi, I enable trial licence for my 3 node elasticsearch cluster, on docker. And now elasticsearch and kibana is running on https but logstash start giving problem. Earlier ELK was running on http correctly. My all setup … [Previous page](https://discuss.elastic.co/latest.md?page=1858) [Next page](https://discuss.elastic.co/latest.md?page=1860)