# Latest **URL:** https://discuss.elastic.co/latest.md?page=1909 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1910 --- ## [Add Geopoint based off of parsed value to logstash config](https://discuss.elastic.co/t/add-geopoint-based-off-of-parsed-value-to-logstash-config/26580)
**Author:** [@russK](https://discuss.elastic.co/u/russK)\ **Replies:** 13\ **Last updated:** [January 5, 2021, 9:03pm UTC](https://discuss.elastic.co/t/add-geopoint-based-off-of-parsed-value-to-logstash-config/26580 "2021-01-05T21:03:45Z")
Hello, Part of my matched message returns the fields %{NUMBER:XCent} %{NUMBER:YCent} which are lat, long points. I'm attempting to add a location pin but keep getting a config failure when i use the --debug flag on… --- ## [Dynamic add/remove indexes alias](https://discuss.elastic.co/t/dynamic-add-remove-indexes-alias/260099)
**Author:** [@Cris.Oporto](https://discuss.elastic.co/u/Cris.Oporto)\ **Replies:** 3\ **Last updated:** [January 5, 2021, 8:55pm UTC](https://discuss.elastic.co/t/dynamic-add-remove-indexes-alias/260099 "2021-01-05T20:55:54Z")
Hi! Currently we are working with a ILP to manage indexes in hot/warm depending on their age. We have noticed retrieving documents from warm indexes is less performant than needed, so, we are thinking in a two steps dat… --- ## [Adding a node from an existing cluster to another cluster](https://discuss.elastic.co/t/adding-a-node-from-an-existing-cluster-to-another-cluster/260252)
**Author:** [@Ryan\_Clark](https://discuss.elastic.co/u/Ryan_Clark)\ **Replies:** 6\ **Last updated:** [January 5, 2021, 8:16pm UTC](https://discuss.elastic.co/t/adding-a-node-from-an-existing-cluster-to-another-cluster/260252 "2021-01-05T20:16:18Z")
I have a single elasticsearch node in it's own cluster (one node cluster) and I have different cluster that has 3 nodes. Both have their own set of data. I want to take the single node and add it to the 3 node cluster t… --- ## [Canvas make autorefresh permanent for user with lower permissions](https://discuss.elastic.co/t/canvas-make-autorefresh-permanent-for-user-with-lower-permissions/260212)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 1\ **Last updated:** [January 5, 2021, 8:15pm UTC](https://discuss.elastic.co/t/canvas-make-autorefresh-permanent-for-user-with-lower-permissions/260212 "2021-01-05T20:15:54Z")
Hi, It is posible to make autorefresh in canvas permanent? it seems that every time that the canvas app is loaded you have to set the autorefresh value --- ## [PostgreSQL Replication Data Metricbeat](https://discuss.elastic.co/t/postgresql-replication-data-metricbeat/260251)
**Author:** [@willis](https://discuss.elastic.co/u/willis)\ **Replies:** 0\ **Last updated:** [January 5, 2021, 7:57pm UTC](https://discuss.elastic.co/t/postgresql-replication-data-metricbeat/260251 "2021-01-05T19:57:09Z")
According to https://github.com/elastic/beats/issues/11234 the Metricbeat PostgreSQL module does not support pulling replication data. Is there a workaround to get important metrics like Replication Lag from PostgreSQL … --- ## [Checking shards creation](https://discuss.elastic.co/t/checking-shards-creation/260192)
**Author:** [@kirillmandrygin](https://discuss.elastic.co/u/kirillmandrygin)\ **Replies:** 1\ **Last updated:** [January 5, 2021, 7:54pm UTC](https://discuss.elastic.co/t/checking-shards-creation/260192 "2021-01-05T19:54:13Z")
When a node hits cluster.max\_shards\_per\_node limit, the cluster status remains green. Logs from elasticsearch: "Caused by: org.elasticsearch.common.ValidationException: Validation Failed: 1: this action would add \[… --- ## [Restore from S3 to multiple ES clusters in parallel](https://discuss.elastic.co/t/restore-from-s3-to-multiple-es-clusters-in-parallel/260250)
**Author:** [@Norman\_Khine](https://discuss.elastic.co/u/Norman_Khine)\ **Replies:** 4\ **Last updated:** [January 5, 2021, 7:48pm UTC](https://discuss.elastic.co/t/restore-from-s3-to-multiple-es-clusters-in-parallel/260250 "2021-01-05T19:48:18Z")
Hello, Would there be any issues with restoring to multiple ES clusters from a single snapshot in parallel from an S3 backup? Will be looking to restore specific indexes into different clusters. Or should this be done… --- ## [Trouble showing data in Vega-lite](https://discuss.elastic.co/t/trouble-showing-data-in-vega-lite/260216)
**Author:** [@Aishna\_Gupta](https://discuss.elastic.co/u/Aishna_Gupta)\ **Replies:** 8\ **Last updated:** [January 5, 2021, 6:47pm UTC](https://discuss.elastic.co/t/trouble-showing-data-in-vega-lite/260216 "2021-01-05T18:47:08Z")
Hello Everyone, I'm new to Vega-lite. I'm trying to plot a bar graph using Vega-lite getting data from an Index. But the data does not show up in the view, only the axes. This is the script I'm using: { "$sch… --- ## [Infinite loop of retryable error code=\>400](https://discuss.elastic.co/t/infinite-loop-of-retryable-error-code-400/260234)
**Author:** [@maxonage](https://discuss.elastic.co/u/maxonage)\ **Replies:** 2\ **Last updated:** [January 5, 2021, 6:09pm UTC](https://discuss.elastic.co/t/infinite-loop-of-retryable-error-code-400/260234 "2021-01-05T18:09:05Z")
Hello, We're using filebeat that sends data to logstash, suddenly we started receiving Encountered a retryable error. Will Retry with exponential backoff {:code=\>400, :url=\>"http://localhost:9200/\_bulk"} From filebea… --- ## [Морфология с Hunspell не работает при поиске](https://discuss.elastic.co/t/hunspell/260189)
**Author:** [@DimanG](https://discuss.elastic.co/u/DimanG)\ **Replies:** 6\ **Last updated:** [January 5, 2021, 5:58pm UTC](https://discuss.elastic.co/t/hunspell/260189 "2021-01-05T17:58:34Z")
Всем доброго дня! В эластике новичок. Остался один шаг до начала использования - побороть морфологию. Проблема схожа с описанной в этой теме, но у меня само не заработало: https://discuss.elastic.co/t/topic/182967/2 По… --- ## [Terms query with large number of items increase latency by number of shards](https://discuss.elastic.co/t/terms-query-with-large-number-of-items-increase-latency-by-number-of-shards/259769)
**Author:** [@nickcanz](https://discuss.elastic.co/u/nickcanz)\ **Replies:** 3\ **Last updated:** [January 5, 2021, 5:57pm UTC](https://discuss.elastic.co/t/terms-query-with-large-number-of-items-increase-latency-by-number-of-shards/259769 "2021-01-05T17:57:48Z")
For requests with a very high terms count, Elasticsearch is taking multiple seconds to return an HTTP 400 error. We had an issue with a production system that produced a query that had 250K items in a terms query and thi… --- ## [Elasticsearch 7.5 erros?](https://discuss.elastic.co/t/elasticsearch-7-5-erros/260105)
**Author:** [@Beuhlet\_Reseau](https://discuss.elastic.co/u/Beuhlet_Reseau)\ **Replies:** 6\ **Last updated:** [January 5, 2021, 5:54pm UTC](https://discuss.elastic.co/t/elasticsearch-7-5-erros/260105 "2021-01-05T17:54:05Z")
Hello, Happy new year. It seems Spark Streaming job was slow into Elasticsearch. I check master and find this erros in log ? \[...\] only morning : \[2021-01-04T01:59:56,349\]\[WARN \]\[o.e.x.m.e.l.LocalExporter\] \[opu309\_m… --- ## [Hot-Warm Architecture with ILM: Cluster health turns yellow](https://discuss.elastic.co/t/hot-warm-architecture-with-ilm-cluster-health-turns-yellow/260244)
**Author:** [@Eduardo\_Iglesias](https://discuss.elastic.co/u/Eduardo_Iglesias)\ **Replies:** 6\ **Last updated:** [January 5, 2021, 5:47pm UTC](https://discuss.elastic.co/t/hot-warm-architecture-with-ilm-cluster-health-turns-yellow/260244 "2021-01-05T17:47:37Z")
Hello community, I'm trying to implement a hot warm architecture but I can't make it work, the cluster health turns yellow. Below are the details of my cluster and some outputs: GET \_cat/indices yellow open test-0000… --- ## [\[7.10\] Que veut dire le status des alerts and actions?](https://discuss.elastic.co/t/7-10-que-veut-dire-le-status-des-alerts-and-actions/260186)
**Author:** [@dao](https://discuss.elastic.co/u/dao)\ **Replies:** 6\ **Last updated:** [January 5, 2021, 4:40pm UTC](https://discuss.elastic.co/t/7-10-que-veut-dire-le-status-des-alerts-and-actions/260186 "2021-01-05T16:40:47Z")
Hello, Je mets en place des alerts et actions (pour remplacer les watchers) Je suis sur elastic-cloud Mon alerte est dans le status pending. Ca veut dire quoi? Je ne vois pas de bouton pour la mettre en mode active P… --- ## [Watcher Exception - Could Not Parse: Unknown Action Type "foreach"](https://discuss.elastic.co/t/watcher-exception-could-not-parse-unknown-action-type-foreach/258631)
**Author:** [@ravinb86](https://discuss.elastic.co/u/ravinb86)\ **Replies:** 3\ **Last updated:** [January 5, 2021, 4:40pm UTC](https://discuss.elastic.co/t/watcher-exception-could-not-parse-unknown-action-type-foreach/258631 "2021-01-05T16:40:15Z")
Hello There, I have a basic watcher to see no. of hits based on a query and send an email per hit. i.e. if my query returns 5 hits, I need to be able to send 5 different emails. To loop through the hits in an array: I f… --- ## [Timelion percentage calculation anomalies](https://discuss.elastic.co/t/timelion-percentage-calculation-anomalies/260137)
**Author:** [@stevezemlicka](https://discuss.elastic.co/u/stevezemlicka)\ **Replies:** 2\ **Last updated:** [January 5, 2021, 4:29pm UTC](https://discuss.elastic.co/t/timelion-percentage-calculation-anomalies/260137 "2021-01-05T16:29:18Z")
I am having an issue with a timelion visualization that calculates the percentage loss. It does this by summing one value from one index and subtracting another value from a different index, the dividing by the original… --- ## [Unable to delete the documents when the index is full](https://discuss.elastic.co/t/unable-to-delete-the-documents-when-the-index-is-full/260201)
**Author:** [@subash](https://discuss.elastic.co/u/subash)\ **Replies:** 6\ **Last updated:** [January 5, 2021, 4:21pm UTC](https://discuss.elastic.co/t/unable-to-delete-the-documents-when-the-index-is-full/260201 "2021-01-05T16:21:43Z")
I am unable to delete the documents from an index having the maximum number of documents (2147483519). getting the below exception. Please help me to get this resolved. "cause" : { "type" : "illegal\_argument\_ex… --- ## [Show different Metrics in one Visualization](https://discuss.elastic.co/t/show-different-metrics-in-one-visualization/260226)
**Author:** [@grra](https://discuss.elastic.co/u/grra)\ **Replies:** 6\ **Last updated:** [January 5, 2021, 4:19pm UTC](https://discuss.elastic.co/t/show-different-metrics-in-one-visualization/260226 "2021-01-05T16:19:56Z")
Hi, in my document I have a JSON metrics field like that: { "task": "task1", "size": 2048 }, { "task": "task2", "size": 1000 } As Buckets I have another field called number (lets say number: 1, 2) A field num… --- ## [ML Advanced datafeed Elasticsearch Query](https://discuss.elastic.co/t/ml-advanced-datafeed-elasticsearch-query/260219)
**Author:** [@Elk\_huh](https://discuss.elastic.co/u/Elk_huh)\ **Replies:** 1\ **Last updated:** [January 5, 2021, 3:49pm UTC](https://discuss.elastic.co/t/ml-advanced-datafeed-elasticsearch-query/260219 "2021-01-05T15:49:30Z")
How do i do query for event.code == 4625 winlog.event\_data.targetusername != "\*svc" this is what i have and doesnt seem to work { "bool": { "must": \[ { "match\_all": {} } \], "filter": \[ { "match\_phrase": { "… --- ## [Render kibana dashboard with API call in Angular10 application](https://discuss.elastic.co/t/render-kibana-dashboard-with-api-call-in-angular10-application/260225)
**Author:** [@manashreea](https://discuss.elastic.co/u/manashreea)\ **Replies:** 1\ **Last updated:** [January 5, 2021, 3:48pm UTC](https://discuss.elastic.co/t/render-kibana-dashboard-with-api-call-in-angular10-application/260225 "2021-01-05T15:48:50Z")
Hello, I want to display Kibana dashboard into Angular application. I know we can use embed url and set iframe src attribute. But I want to get dashboard report by making Kibana dashboard API call. And this API response… --- ## [How to avoid duplicate data in data table visualization](https://discuss.elastic.co/t/how-to-avoid-duplicate-data-in-data-table-visualization/260182)
**Author:** [@abhinav3](https://discuss.elastic.co/u/abhinav3)\ **Replies:** 1\ **Last updated:** [January 5, 2021, 3:39pm UTC](https://discuss.elastic.co/t/how-to-avoid-duplicate-data-in-data-table-visualization/260182 "2021-01-05T15:39:26Z")
I have data where I have customer names and devices linked to it. I want to visualize this on a data table. For this, I have added top hit as aggregation in metrics and have used field as Device. In the bucket, I have a… --- ## [Logstash Persistent Queue Buffer time](https://discuss.elastic.co/t/logstash-persistent-queue-buffer-time/260211)
**Author:** [@ksaha](https://discuss.elastic.co/u/ksaha)\ **Replies:** 2\ **Last updated:** [January 5, 2021, 2:29pm UTC](https://discuss.elastic.co/t/logstash-persistent-queue-buffer-time/260211 "2021-01-05T14:29:04Z")
Hi, I am exploring on Logstash resiliency part and come to know about the logstash Persistent Queue. I am searching what is the maximum buffer time of this Persistent Queue? Our requirement is the buffer should hold the… --- ## [AWS EC2 Logstash input with external IPs](https://discuss.elastic.co/t/aws-ec2-logstash-input-with-external-ips/260202)
**Author:** [@Sunflower](https://discuss.elastic.co/u/Sunflower)\ **Replies:** 0\ **Last updated:** [January 5, 2021, 12:16pm UTC](https://discuss.elastic.co/t/aws-ec2-logstash-input-with-external-ips/260202 "2021-01-05T12:16:20Z")
(topic withdrawn by author, will be automatically deleted in 24 hours unless flagged) --- ## [Using kibana alerting with filters](https://discuss.elastic.co/t/using-kibana-alerting-with-filters/259956)
**Author:** [@VAX](https://discuss.elastic.co/u/VAX)\ **Replies:** 1\ **Last updated:** [January 5, 2021, 2:19pm UTC](https://discuss.elastic.co/t/using-kibana-alerting-with-filters/259956 "2021-01-05T14:19:10Z")
hi all, im quite new with kibana i have kibana filled with messages coming from my equipment. i created an inverted filtered of "blacklist" so i will see the only ones i care about. now i want to create an alert that… --- ## [Filebeat stopped sending the log entries](https://discuss.elastic.co/t/filebeat-stopped-sending-the-log-entries/260217)
**Author:** [@Saravana37](https://discuss.elastic.co/u/Saravana37)\ **Replies:** 1\ **Last updated:** [January 5, 2021, 2:13pm UTC](https://discuss.elastic.co/t/filebeat-stopped-sending-the-log-entries/260217 "2021-01-05T14:13:48Z")
Hello , We have a typical issue here. Filebeat suddenly stopped sending the log entries and i can see the below message in the log. 2021-01-05T14:58:50.314+0100 INFO \[monitoring\] log/log.go:144 Non-zero metr… --- ## [How to save large data send from logstash to Redis with list type?](https://discuss.elastic.co/t/how-to-save-large-data-send-from-logstash-to-redis-with-list-type/260210)
**Author:** [@iooi](https://discuss.elastic.co/u/iooi)\ **Replies:** 0\ **Last updated:** [January 5, 2021, 1:30pm UTC](https://discuss.elastic.co/t/how-to-save-large-data-send-from-logstash-to-redis-with-list-type/260210 "2021-01-05T13:30:24Z")
I'm using logstash to send data to Redis as output { redis { host =\> \["${REDIS\_URL}"\] data\_type =\> "list" key =\> "ID" codec =\> line { format =\> "%{id}"} } } When I check data in Redis, it created an… --- ## [LogStash::Outputs::ElasticSearch::HttpClient::Pool::BadResponseCodeError: Got response code '401' contacting Elasticsearc](https://discuss.elastic.co/t/logstash-got-response-code-401-contacting-elasticsearc/260209)
**Author:** [@gitusersybchina](https://discuss.elastic.co/u/gitusersybchina)\ **Replies:** 0\ **Last updated:** [January 5, 2021, 1:27pm UTC](https://discuss.elastic.co/t/logstash-got-response-code-401-contacting-elasticsearc/260209 "2021-01-05T13:27:31Z")
when I deploy logstash in k8s and config out to es，the pod has occur this error log: LogStash::Outputs::ElasticSearch::HttpClient::Pool::BadResponseCodeError: Got response code '401' contacting Elasticsearch Failed to … --- ## [Elastic receives small amount of data and nginx buffers the bulk events](https://discuss.elastic.co/t/elastic-receives-small-amount-of-data-and-nginx-buffers-the-bulk-events/259578)
**Author:** [@opouwels](https://discuss.elastic.co/u/opouwels)\ **Replies:** 6\ **Last updated:** [January 5, 2021, 12:30pm UTC](https://discuss.elastic.co/t/elastic-receives-small-amount-of-data-and-nginx-buffers-the-bulk-events/259578 "2021-01-05T12:30:22Z")
Hi List, Sinces we switched from fluentd to fluent-bit our elastic cluster showed more problems with the bulk queue, is their a way to see whats in the bulk queue and why its not progressing the queue? the nginx shows … --- ## [Pause Young (Allocation Failure) in gc.log](https://discuss.elastic.co/t/pause-young-allocation-failure-in-gc-log/260100)
**Author:** [@mtudisco](https://discuss.elastic.co/u/mtudisco)\ **Replies:** 2\ **Last updated:** [January 5, 2021, 12:24pm UTC](https://discuss.elastic.co/t/pause-young-allocation-failure-in-gc-log/260100 "2021-01-05T12:24:26Z")
Hi, I've been having these errors in gc.log in elasticsearch (7.3), and sometimes elasticsearch crushes, dont know if because of theese errors. Can anyone help to identifiy what does it mean? \[2021-01-04T14:36:14.097+0… --- ## [Logs correlation](https://discuss.elastic.co/t/logs-correlation/260110)
**Author:** [@sm\_loguser](https://discuss.elastic.co/u/sm_loguser)\ **Replies:** 2\ **Last updated:** [January 5, 2021, 12:22pm UTC](https://discuss.elastic.co/t/logs-correlation/260110 "2021-01-05T12:22:47Z")
I have two log files. I am correlating these two files by timestamp using aggregate filter. Where there is timestamp match between two files, correlation is working fine. But there are scenarios where either of the two… [Previous page](https://discuss.elastic.co/latest.md?page=1908) [Next page](https://discuss.elastic.co/latest.md?page=1910)