# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=1007 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1008 --- ## [How the real data is stored in data disk?](https://discuss.elastic.co/t/how-the-real-data-is-stored-in-data-disk/267476)
**Author:** [@Jax\_dev](https://discuss.elastic.co/u/Jax_dev)\ **Replies:** 1\ **Last updated:** [March 22, 2021, 1:58am UTC](https://discuss.elastic.co/t/how-the-real-data-is-stored-in-data-disk/267476 "2021-03-22T01:58:46Z")
I have executed below api GET "/\_cat/shards?v" it has shown all the indices in which one of the indices has taken 302 GB. When I have checked the mounted disk ( mentioned in path.data ) which elastic is being used, it s… --- ## [How much disk storage required to take backup of index which is having 300GB?](https://discuss.elastic.co/t/how-much-disk-storage-required-to-take-backup-of-index-which-is-having-300gb/267424)
**Author:** [@Jax\_dev](https://discuss.elastic.co/u/Jax_dev)\ **Replies:** 12\ **Last updated:** [March 22, 2021, 1:55am UTC](https://discuss.elastic.co/t/how-much-disk-storage-required-to-take-backup-of-index-which-is-having-300gb/267424 "2021-03-22T01:55:57Z")
If we want to take a back of one of the indices which is having 300GB, enabling compression - true. How much space snapshot will occupy? How do we take snapshot to azure blob storage? Elastic server cluster is on azure… --- ## [How to fix Unassigned state for my indexes?](https://discuss.elastic.co/t/how-to-fix-unassigned-state-for-my-indexes/267560)
**Author:** [@andy1122](https://discuss.elastic.co/u/andy1122)\ **Replies:** 1\ **Last updated:** [March 22, 2021, 1:54am UTC](https://discuss.elastic.co/t/how-to-fix-unassigned-state-for-my-indexes/267560 "2021-03-22T01:54:08Z")
I have ElasticSearch configured in Docker and loading data from Magento into ES via indexer. When quering ES indexes I can see all the data is there but when I try to access it from my localhost:8080 where my connection … --- ## [Elastic and kibana 7.12 (or higher) compatibility with logstash , beats etc older 7.x](https://discuss.elastic.co/t/elastic-and-kibana-7-12-or-higher-compatibility-with-logstash-beats-etc-older-7-x/267850)
**Author:** [@xyz2](https://discuss.elastic.co/u/xyz2)\ **Replies:** 1\ **Last updated:** [March 22, 2021, 12:47am UTC](https://discuss.elastic.co/t/elastic-and-kibana-7-12-or-higher-compatibility-with-logstash-beats-etc-older-7-x/267850 "2021-03-22T00:47:26Z")
HI, Is elasticsearch and kibana 7.12 or 7.13 compatible with logstash, metricbeat, filebeat, heartbeat 7.x older version ? I see the that it is compatible until 7.11 though. --- ## ["reason"=\>"failed to parse field \[Time\] of type \[date\] in document with id 'xxxxxxxxxxxxxxx'](https://discuss.elastic.co/t/reason-failed-to-parse-field-time-of-type-date-in-document-with-id-xxxxxxxxxxxxxxx/267473)
**Author:** [@BlackCat](https://discuss.elastic.co/u/BlackCat)\ **Replies:** 2\ **Last updated:** [March 22, 2021, 12:26am UTC](https://discuss.elastic.co/t/reason-failed-to-parse-field-time-of-type-date-in-document-with-id-xxxxxxxxxxxxxxx/267473 "2021-03-22T00:26:35Z")
I set config of logstash, But happen warning message. Please, how to do resolve. I want to send below log to Elasticsearch. ////////////////// 2021-03-17 10:27:50.115 +0900 26240 main : INFO com.tableausoftware.acti… --- ## [Yum repos returning: Not Found](https://discuss.elastic.co/t/yum-repos-returning-not-found/267924)
**Author:** [@lachlan.simpson](https://discuss.elastic.co/u/lachlan.simpson)\ **Replies:** 3\ **Last updated:** [March 21, 2021, 11:50pm UTC](https://discuss.elastic.co/t/yum-repos-returning-not-found/267924 "2021-03-21T23:50:12Z")
Following the documentation for installation, I'm getting not found on the regular and oss repositories? I'm not the first to experience this in 2021. Has the OS installation method been deprecated but not removed from… --- ## [Elastic Search Null pointer exception in two different join types while fetching their parents](https://discuss.elastic.co/t/elastic-search-null-pointer-exception-in-two-different-join-types-while-fetching-their-parents/267922)
**Author:** [@Syed\_ali\_abbas\_shah](https://discuss.elastic.co/u/Syed_ali_abbas_shah)\ **Replies:** 0\ **Last updated:** [March 21, 2021, 11:00pm UTC](https://discuss.elastic.co/t/elastic-search-null-pointer-exception-in-two-different-join-types-while-fetching-their-parents/267922 "2021-03-21T23:00:58Z")
I have very simple mapping in Elastic Search 6.x version, and following is my mapping with two different types bookmarks user can also be bookmarked and post can also be bookmarked, { "properties": { "type": { … --- ## [Storing value and attaching it later](https://discuss.elastic.co/t/storing-value-and-attaching-it-later/267892)
**Author:** [@thaideval](https://discuss.elastic.co/u/thaideval)\ **Replies:** 2\ **Last updated:** [March 21, 2021, 4:10pm UTC](https://discuss.elastic.co/t/storing-value-and-attaching-it-later/267892 "2021-03-21T16:10:14Z")
Hello, so i have an event like this: A B С B С .. B С And i can parse it getting "A" value + making an array of "B" and "C". That's how i am handling it right now. But i got curious - if it's possible to store … --- ## [Best way to handle "circuit\_breaking\_exception"](https://discuss.elastic.co/t/best-way-to-handle-circuit-breaking-exception/267913)
**Author:** [@Leibo](https://discuss.elastic.co/u/Leibo)\ **Replies:** 0\ **Last updated:** [March 21, 2021, 4:13pm UTC](https://discuss.elastic.co/t/best-way-to-handle-circuit-breaking-exception/267913 "2021-03-21T16:13:50Z")
Hi, Our micro-service is written in Java. We are facing the "circuit\_breaking\_exception" exception occasionally while trying to index documents from multiple threads. How is the best way to handle it without changing … --- ## [Possiblities of bucket level subtraction](https://discuss.elastic.co/t/possiblities-of-bucket-level-subtraction/267911)
**Author:** [@venkat\_swaminathan](https://discuss.elastic.co/u/venkat_swaminathan)\ **Replies:** 0\ **Last updated:** [March 21, 2021, 3:46pm UTC](https://discuss.elastic.co/t/possiblities-of-bucket-level-subtraction/267911 "2021-03-21T15:46:36Z")
Good Day, I am collecting metric information from my provider and pushing them to ES through a python script. all I need to do is subtract "MetricName" , (i.e: Count - 5xx) with respect to time on total system availabi… --- ## [Error in Lab 6.2 Engineer II?](https://discuss.elastic.co/t/error-in-lab-6-2-engineer-ii/267797)
**Author:** [@pbroek](https://discuss.elastic.co/u/pbroek)\ **Replies:** 2\ **Last updated:** [March 21, 2021, 3:31pm UTC](https://discuss.elastic.co/t/error-in-lab-6-2-engineer-ii/267797 "2021-03-21T15:31:54Z")
Hello, While working on Lab 6.2 I read the following question: In the same request, remove logs\_server1 from the access\_logs alias and update the same alias to write to logs\_server5 instead of logs\_server4 But in the… --- ## [Extracting a field further after its been parsed by Grok Filter](https://discuss.elastic.co/t/extracting-a-field-further-after-its-been-parsed-by-grok-filter/267883)
**Author:** [@rmoss25](https://discuss.elastic.co/u/rmoss25)\ **Replies:** 3\ **Last updated:** [March 21, 2021, 12:44pm UTC](https://discuss.elastic.co/t/extracting-a-field-further-after-its-been-parsed-by-grok-filter/267883 "2021-03-21T12:44:48Z")
HI, Is there a way to parse a field further after its already been parsed by grok? So after I parse out DN from the main message, I now want to parse DN further as it contains a username. So I want to parse out test.T… --- ## [Elastic node js client point in time syntax](https://discuss.elastic.co/t/elastic-node-js-client-point-in-time-syntax/267903)
**Author:** [@111452](https://discuss.elastic.co/u/111452)\ **Replies:** 0\ **Last updated:** [March 21, 2021, 10:13am UTC](https://discuss.elastic.co/t/elastic-node-js-client-point-in-time-syntax/267903 "2021-03-21T10:13:58Z")
Can someone show me the right syntax for using point in time in elastic search on node js client. I'm trying like this: const body = { query: { geo\_shape: { geometry: { relation: 'wit… --- ## [Create Custom Visualization for Kibana](https://discuss.elastic.co/t/create-custom-visualization-for-kibana/267837)
**Author:** [@mastersmit](https://discuss.elastic.co/u/mastersmit)\ **Replies:** 10\ **Last updated:** [March 21, 2021, 9:51am UTC](https://discuss.elastic.co/t/create-custom-visualization-for-kibana/267837 "2021-03-21T09:51:29Z")
I have a requirement to create a visualisation that replicates one of the legacy system. In the below screenshot it shows the expected and what i have so far... I could create a frontend, but was hoping if there is a w… --- ## [Using Nest, queries returning with 0 hits](https://discuss.elastic.co/t/using-nest-queries-returning-with-0-hits/267037)
**Author:** [@asimsek99](https://discuss.elastic.co/u/asimsek99)\ **Replies:** 4\ **Last updated:** [March 21, 2021, 9:22am UTC](https://discuss.elastic.co/t/using-nest-queries-returning-with-0-hits/267037 "2021-03-21T09:22:30Z")
Hey hey, Env: .net Core, Nest, Elasticsearch I had my queries running with using Logstash and Elastic with AWS. Decided to not use logstash and move to cloud.elastic.co. Trying to migrate the current queries to cloud.… --- ## [Unable to parse TIMESTAMP\_ISO8601 timestamp in logstash conf](https://discuss.elastic.co/t/unable-to-parse-timestamp-iso8601-timestamp-in-logstash-conf/267886)
**Author:** [@Micheal25](https://discuss.elastic.co/u/Micheal25)\ **Replies:** 2\ **Last updated:** [March 20, 2021, 7:52pm UTC](https://discuss.elastic.co/t/unable-to-parse-timestamp-iso8601-timestamp-in-logstash-conf/267886 "2021-03-20T19:52:59Z")
Hi Team, I am having parsing the "TIMESTAMP\_ISO8601" in logstash grok. The only differnce i see in the log message is extra space after the hours : in timestamp Eg: 2021-03-21T13:(\\s) 01:54.402+0000 this is occuring … --- ## [Multiline and csv filter](https://discuss.elastic.co/t/multiline-and-csv-filter/267888)
**Author:** [@vincedt09](https://discuss.elastic.co/u/vincedt09)\ **Replies:** 0\ **Last updated:** [March 20, 2021, 1:54pm UTC](https://discuss.elastic.co/t/multiline-and-csv-filter/267888 "2021-03-20T13:54:53Z")
Hi! I want to visualize in kibana map geo points with specific information(ex: latitude, longitude) csv { separator =\> "," skip\_empty\_rows =\> true columns =\> \[ "latitude","longitude" \] }… --- ## [Support matrix: luberjack plugin](https://discuss.elastic.co/t/support-matrix-luberjack-plugin/267875)
**Author:** [@smm](https://discuss.elastic.co/u/smm)\ **Replies:** 1\ **Last updated:** [March 20, 2021, 4:25pm UTC](https://discuss.elastic.co/t/support-matrix-luberjack-plugin/267875 "2021-03-20T16:25:47Z")
Dear elasic colleagues, what I do not understand: You provide a support matrix for the logstash plugins In this matrix I do not find the lumberjack output plugin. This means for me: this plugin is not supported anym… --- ## [Logstash does not read rewritable csv file well](https://discuss.elastic.co/t/logstash-does-not-read-rewritable-csv-file-well/267880)
**Author:** [@Andrew\_Foxis](https://discuss.elastic.co/u/Andrew_Foxis)\ **Replies:** 1\ **Last updated:** [March 20, 2021, 4:20pm UTC](https://discuss.elastic.co/t/logstash-does-not-read-rewritable-csv-file-well/267880 "2021-03-20T16:20:59Z")
Hi all. I have csv file: addr;peer;port;name;datetime (headers) 172.12.10.1; 34.15.67.43; 1123; peter; 2021-03-15 00:02:34 ( value rows (100-200 rows)) This file rewritable every 5 minutes. I want to get the full con… --- ## [Performance implications for elasticsearch when specifying fields that won't be in the indexed documents?](https://discuss.elastic.co/t/performance-implications-for-elasticsearch-when-specifying-fields-that-wont-be-in-the-indexed-documents/267858)
**Author:** [@Supermathie](https://discuss.elastic.co/u/Supermathie)\ **Replies:** 0\ **Last updated:** [March 19, 2021, 8:18pm UTC](https://discuss.elastic.co/t/performance-implications-for-elasticsearch-when-specifying-fields-that-wont-be-in-the-indexed-documents/267858 "2021-03-19T20:18:03Z")
I'm working on switching to using the ECS toolchain for our indices (mostly logs). The usage notes for the generator say: If your indices will never populate particular ECS fields, there's no need to include those fie… --- ## [Doublon logstash](https://discuss.elastic.co/t/doublon-logstash/267867)
**Author:** [@lali](https://discuss.elastic.co/u/lali)\ **Replies:** 7\ **Last updated:** [March 20, 2021, 1:35pm UTC](https://discuss.elastic.co/t/doublon-logstash/267867 "2021-03-20T13:35:26Z")
Bonjour, Dans mon output je met ca comme variable : document\_id =\> "%{\_id}" Mais comment le mettre dans le output kafka ? Merci d'avance --- ## [Kubernetes - Multiple cluster on same Elastic installation](https://discuss.elastic.co/t/kubernetes-multiple-cluster-on-same-elastic-installation/265423)
**Author:** [@dekim](https://discuss.elastic.co/u/dekim)\ **Replies:** 2\ **Last updated:** [March 20, 2021, 1:25pm UTC](https://discuss.elastic.co/t/kubernetes-multiple-cluster-on-same-elastic-installation/265423 "2021-03-20T13:25:49Z")
Hello guys! We are currently using Elastic to monitor our stack. We do have multiple GKE (Google Kubernetes Engine) cluster, and I would like to have their logs sent to the same Elastic Instance. Is there a recommende… --- ## [Filter with scripted field](https://discuss.elastic.co/t/filter-with-scripted-field/267673)
**Author:** [@Mahibul](https://discuss.elastic.co/u/Mahibul)\ **Replies:** 2\ **Last updated:** [March 20, 2021, 12:58pm UTC](https://discuss.elastic.co/t/filter-with-scripted-field/267673 "2021-03-20T12:58:29Z")
Hi, I have created a scripted field test and the script is if (params\['\_source'\]\['additional'\] == null) { return -1 } return params\['\_source'\]\['additional'\].length() The type of the field is number. This works fin… --- ## [Voice alarm when fire a watch](https://discuss.elastic.co/t/voice-alarm-when-fire-a-watch/267855)
**Author:** [@lstoneir](https://discuss.elastic.co/u/lstoneir)\ **Replies:** 1\ **Last updated:** [March 20, 2021, 7:23am UTC](https://discuss.elastic.co/t/voice-alarm-when-fire-a-watch/267855 "2021-03-20T07:23:16Z")
Hi, is there any way to play a voice or sound when firing a watch in kibana 7.10 ? --- ## [How to delete a data node](https://discuss.elastic.co/t/how-to-delete-a-data-node/267511)
**Author:** [@smm](https://discuss.elastic.co/u/smm)\ **Replies:** 1\ **Last updated:** [March 20, 2021, 6:46am UTC](https://discuss.elastic.co/t/how-to-delete-a-data-node/267511 "2021-03-20T06:46:03Z")
Hi there, I would like to delete one of many data nodes in production. There is stille plenty of space and the data node has only this role. Life can be so simple: stop the service and delte the machine. Is this all,… --- ## [Alerts don't fire](https://discuss.elastic.co/t/alerts-dont-fire/267174)
**Author:** [@ShadwDrgn](https://discuss.elastic.co/u/ShadwDrgn)\ **Replies:** 11\ **Last updated:** [March 19, 2021, 11:41pm UTC](https://discuss.elastic.co/t/alerts-dont-fire/267174 "2021-03-19T23:41:21Z")
I feel like the attached image should not be possible since it's checking every minute and CLEARLY should be active, but is in an okay state? Alerts only become active one time for me... Once they recover, they seem to n… --- ## [Logstash new install: response code '403' contacting Elasticsearch](https://discuss.elastic.co/t/logstash-new-install-response-code-403-contacting-elasticsearch/267862)
**Author:** [@kmp](https://discuss.elastic.co/u/kmp)\ **Replies:** 0\ **Last updated:** [March 19, 2021, 8:45pm UTC](https://discuss.elastic.co/t/logstash-new-install-response-code-403-contacting-elasticsearch/267862 "2021-03-19T20:45:20Z")
Posting this for the record, should anyone else run into the same problem... LogStash::Outputs::ElasticSearch::HttpClient::Pool::BadResponseCodeError: Got response code '403' contacting Elasticsearch at URL 'https://es0… --- ## [Kibana shows empty pages](https://discuss.elastic.co/t/kibana-shows-empty-pages/267848)
**Author:** [@iatalay](https://discuss.elastic.co/u/iatalay)\ **Replies:** 1\ **Last updated:** [March 19, 2021, 8:30pm UTC](https://discuss.elastic.co/t/kibana-shows-empty-pages/267848 "2021-03-19T20:30:47Z")
Hi We have install Elasticsearch and Kibana 7.11.1 on RHEL 8.3. (Also I tried RHEL 7.9 for Kibana). We also have installed search-guard plugin. Some of the pages on Kibana are empty, show nothing. Tried firefox, chro… --- ## [How to set up a highly available elasticsearch cluster locally?](https://discuss.elastic.co/t/how-to-set-up-a-highly-available-elasticsearch-cluster-locally/267803)
**Author:** [@Belgacem\_Ghiloufi](https://discuss.elastic.co/u/Belgacem_Ghiloufi)\ **Replies:** 4\ **Last updated:** [March 19, 2021, 8:05pm UTC](https://discuss.elastic.co/t/how-to-set-up-a-highly-available-elasticsearch-cluster-locally/267803 "2021-03-19T20:05:13Z")
I am new to Elasticsearch and I want to set up a highly available Elasticsearch cluster on one machine to test and learn how to use Elasticsearch. I hope that when the master node fails, one of the other nodes will take … --- ## [Visualization- ASA Flows by Network Bytes not showing in GB or MB](https://discuss.elastic.co/t/visualization-asa-flows-by-network-bytes-not-showing-in-gb-or-mb/267825)
**Author:** [@ajesh](https://discuss.elastic.co/u/ajesh)\ **Replies:** 4\ **Last updated:** [March 19, 2021, 5:20pm UTC](https://discuss.elastic.co/t/visualization-asa-flows-by-network-bytes-not-showing-in-gb-or-mb/267825 "2021-03-19T17:20:38Z")
Hi Team, I would like to know how i can have the below graph show the GB/MB in the Y-Axis. Now its showing as Just the number , i need to change it to show as eg 1GB or 2GB etc. Please help Thanks, Ajesh [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1006) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1008)