# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1015 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1016 --- ## [Deleting Kibana Index patterns and dependencies](https://discuss.elastic.co/t/deleting-kibana-index-patterns-and-dependencies/299111)
**Author:** [@nkuntla](https://discuss.elastic.co/u/nkuntla)\ **Replies:** 5\ **Last updated:** [March 14, 2022, 3:09pm UTC](https://discuss.elastic.co/t/deleting-kibana-index-patterns-and-dependencies/299111 "2022-03-14T15:09:52Z")
Trying to delete multiple index patterns in our kibana instance that are junk. Some questions related to this. Will deleting the index pattern delete dependent visualizations and dashboards? Will the delete fail if th… --- ## [java.lang.OutOfMemoryError: Java heap space](https://discuss.elastic.co/t/java-lang-outofmemoryerror-java-heap-space/299620)
**Author:** [@Ahmed\_El\_bendary](https://discuss.elastic.co/u/Ahmed_El_bendary)\ **Replies:** 1\ **Last updated:** [March 14, 2022, 2:55pm UTC](https://discuss.elastic.co/t/java-lang-outofmemoryerror-java-heap-space/299620 "2022-03-14T14:55:32Z")
when using prefix query with large text give exception then service will stop. { "track\_total\_hits": true, "from": 0, "query": { "bool": { "minimum\_should\_match": 1, "must": \[ { "… --- ## [Logstash stopped processing because of an error: (SystemExit) exit](https://discuss.elastic.co/t/logstash-stopped-processing-because-of-an-error-systemexit-exit/299474)
**Author:** [@paulov](https://discuss.elastic.co/u/paulov)\ **Replies:** 7\ **Last updated:** [March 14, 2022, 2:25pm UTC](https://discuss.elastic.co/t/logstash-stopped-processing-because-of-an-error-systemexit-exit/299474 "2022-03-14T14:25:31Z")
Hi, After instaling/configuring logstash, I get this error: \[2022-03-11T09:22:27,379\]\[INFO \]\[logstash.runner \] Log4j configuration path used is: /u02/logstash\_frontend/etc/log4j2.properties \[2022-03-11T09:22:… --- ## [Error when clone index](https://discuss.elastic.co/t/error-when-clone-index/299504)
**Author:** [@Muhammad\_Fhadli](https://discuss.elastic.co/u/Muhammad_Fhadli)\ **Replies:** 1\ **Last updated:** [March 14, 2022, 1:31pm UTC](https://discuss.elastic.co/t/error-when-clone-index/299504 "2022-03-14T13:31:08Z")
I want to clone my index, i have done what shown in this page to clone the index using this command. POST /my\_index/\_clone/my\_index\_clone I also tried to make the index read-only first with this command PUT /my\_index… --- ## [Geoip losing type geo\_point for location (v8.1)](https://discuss.elastic.co/t/geoip-losing-type-geo-point-for-location-v8-1/299623)
**Author:** [@fedora35](https://discuss.elastic.co/u/fedora35)\ **Replies:** 0\ **Last updated:** [March 14, 2022, 1:20pm UTC](https://discuss.elastic.co/t/geoip-losing-type-geo-point-for-location-v8-1/299623 "2022-03-14T13:20:44Z")
Hello, I'm a beginner with ELK and i have the following problem: I send apache's logs with filebeat to logstash. All is working except the fact when I check the location mapping in kibana, it has no type : it appears l… --- ## [Create service unit for Auditbeat for Debian](https://discuss.elastic.co/t/create-service-unit-for-auditbeat-for-debian/299622)
**Author:** [@helkmaster](https://discuss.elastic.co/u/helkmaster)\ **Replies:** 0\ **Last updated:** [March 14, 2022, 1:16pm UTC](https://discuss.elastic.co/t/create-service-unit-for-auditbeat-for-debian/299622 "2022-03-14T13:16:44Z")
For DEB and RPM there is by default a serivce unit when you want to start Auditbeat. I currently work on a Debian distribution and I want to create a service unit for Auditbeat because I want to run it in the background… --- ## [Reference a value from new added field within grok match setting](https://discuss.elastic.co/t/reference-a-value-from-new-added-field-within-grok-match-setting/299619)
**Author:** [@mstojanovic](https://discuss.elastic.co/u/mstojanovic)\ **Replies:** 0\ **Last updated:** [March 14, 2022, 12:33pm UTC](https://discuss.elastic.co/t/reference-a-value-from-new-added-field-within-grok-match-setting/299619 "2022-03-14T12:33:59Z")
Hi, I'm trying to reference a value from a new field that was added with mutate plugin. I try to reference it within a grok match settings. Part of the filter pipeline looks like: filter { mutate { add\_… --- ## [How to overwrite system generated .monitoring-\* templates in elasticsearch 8.0](https://discuss.elastic.co/t/how-to-overwrite-system-generated-monitoring-templates-in-elasticsearch-8-0/299618)
**Author:** [@BhawanaSharma](https://discuss.elastic.co/u/BhawanaSharma)\ **Replies:** 0\ **Last updated:** [March 14, 2022, 12:33pm UTC](https://discuss.elastic.co/t/how-to-overwrite-system-generated-monitoring-templates-in-elasticsearch-8-0/299618 "2022-03-14T12:33:33Z")
In Elasticsearch 8.0 few system generated templates are coming by default named with ".monitoring-\*" in that "number\_of\_replicas: 1" with default value 1, because of that replica is set to 1 and health of data stream is … --- ## [Pie chart - show last string value of two records with same ID](https://discuss.elastic.co/t/pie-chart-show-last-string-value-of-two-records-with-same-id/299614)
**Author:** [@Jakub\_Polcar](https://discuss.elastic.co/u/Jakub_Polcar)\ **Replies:** 0\ **Last updated:** [March 14, 2022, 12:22pm UTC](https://discuss.elastic.co/t/pie-chart-show-last-string-value-of-two-records-with-same-id/299614 "2022-03-14T12:22:15Z")
Hello, is there an option how to set up a pie chart to show count of last string values, but if there are two records with same ID, count only last one based on timestamp? Test records: record 1: ID: 123, variable: "v… --- ## [Dashboard Watcher URL](https://discuss.elastic.co/t/dashboard-watcher-url/299613)
**Author:** [@Angad\_Panesar1](https://discuss.elastic.co/u/Angad_Panesar1)\ **Replies:** 0\ **Last updated:** [March 14, 2022, 12:18pm UTC](https://discuss.elastic.co/t/dashboard-watcher-url/299613 "2022-03-14T12:18:27Z")
Hi Is there an option that can allow me to generate a dashboard PDF in landscape mode? When I printed it, it only prints it in A4 portrait mode. Also, in the post URL shown below. I want the watcher to automatically ge… --- ## [Filebeat with custom logfile and kubernetes metadata to elasticsearch and kibana](https://discuss.elastic.co/t/filebeat-with-custom-logfile-and-kubernetes-metadata-to-elasticsearch-and-kibana/299403)
**Author:** [@v\_anil](https://discuss.elastic.co/u/v_anil)\ **Replies:** 0\ **Last updated:** [March 11, 2022, 6:40am UTC](https://discuss.elastic.co/t/filebeat-with-custom-logfile-and-kubernetes-metadata-to-elasticsearch-and-kibana/299403 "2022-03-11T06:40:08Z")
Our applications are deployed in AWS EKS cluster, and for certain reasons we need to write our app logs to separate file lets say ${POD\_NAME}.applog instead of stdout (we mounted /var/log/container/ to the pod /log folde… --- ## [Reindex change shard number](https://discuss.elastic.co/t/reindex-change-shard-number/299337)
**Author:** [@gabbar](https://discuss.elastic.co/u/gabbar)\ **Replies:** 4\ **Last updated:** [March 14, 2022, 12:02pm UTC](https://discuss.elastic.co/t/reindex-change-shard-number/299337 "2022-03-14T12:02:39Z")
Hello community! I'm running Elasticsearch 6.8 to store logs collected using graylog and I would like to reduce the amount of shards of the older indices. Using curator I've been able to shrink the shards from 6 to 1, … --- ## [Hide field of document in Kibana](https://discuss.elastic.co/t/hide-field-of-document-in-kibana/299599)
**Author:** [@Voula\_Mikr](https://discuss.elastic.co/u/Voula_Mikr)\ **Replies:** 1\ **Last updated:** [March 14, 2022, 10:56am UTC](https://discuss.elastic.co/t/hide-field-of-document-in-kibana/299599 "2022-03-14T10:56:37Z")
Hi, We have made some dashboards in Kibana that also include the table with all the data of a specific index pattern. There is a new field ("hash") added in documents of some index patterns but we need to "hide" it in … --- ## [Net Client NEST 8 download?](https://discuss.elastic.co/t/net-client-nest-8-download/298558)
**Author:** [@agonzalez](https://discuss.elastic.co/u/agonzalez)\ **Replies:** 3\ **Last updated:** [March 14, 2022, 10:07am UTC](https://discuss.elastic.co/t/net-client-nest-8-download/298558 "2022-03-14T10:07:49Z")
Elastic 8 was released few weeks ago and NEST 8 documentation is online but I cant find NEST 8 nuget package. When it is going to be published or where I can download final release or a beta? --- ## [Can we use Elasticsearch-dsl-py 7.4 with Elasticsearch-8.x?](https://discuss.elastic.co/t/can-we-use-elasticsearch-dsl-py-7-4-with-elasticsearch-8-x/299402)
**Author:** [@Dheeraj\_Gupta](https://discuss.elastic.co/u/Dheeraj_Gupta)\ **Replies:** 2\ **Last updated:** [March 14, 2022, 10:05am UTC](https://discuss.elastic.co/t/can-we-use-elasticsearch-dsl-py-7-4-with-elasticsearch-8-x/299402 "2022-03-14T10:05:03Z")
We have some Python programs that use Elasticsearch-dsl-py and Elasticsearch-py Python clients to process Elasticsearch data. We are considering upgrading to Elasticsearch-8. From PyPI we can see that elasticsearch-py-8.… --- ## [Harvester\_buffer\_size - why increase it?](https://discuss.elastic.co/t/harvester-buffer-size-why-increase-it/299226)
**Author:** [@mikewillis](https://discuss.elastic.co/u/mikewillis)\ **Replies:** 2\ **Last updated:** [March 14, 2022, 10:04am UTC](https://discuss.elastic.co/t/harvester-buffer-size-why-increase-it/299226 "2022-03-14T10:04:49Z")
The documentation says what the harvest\_buffer\_size setting of the log input is for, but I don't see anything about why one might want to change it. I noticed that a Filebeat 7.17 instance on a CentOS 7 server that is… --- ## [Beats Logs differentiation based on Environment in Kibana UI](https://discuss.elastic.co/t/beats-logs-differentiation-based-on-environment-in-kibana-ui/299500)
**Author:** [@helper](https://discuss.elastic.co/u/helper)\ **Replies:** 2\ **Last updated:** [March 14, 2022, 9:58am UTC](https://discuss.elastic.co/t/beats-logs-differentiation-based-on-environment-in-kibana-ui/299500 "2022-03-14T09:58:51Z")
Hi there, I am looking for some help to differentiate the logs which I am sending from various environments to the Elastic. Flow : File Beat -\> Logstash -\> Elastic -\> Kibana. I would like to see the logs which I pushed… --- ## [Monitor/alert beats dropped events](https://discuss.elastic.co/t/monitor-alert-beats-dropped-events/295591)
**Author:** [@smueller](https://discuss.elastic.co/u/smueller)\ **Replies:** 7\ **Last updated:** [March 14, 2022, 8:28am UTC](https://discuss.elastic.co/t/monitor-alert-beats-dropped-events/295591 "2022-03-14T08:28:42Z")
Hi, i need to alert me on filebeat dropping events. Even better alerting me on the kind of error that lead to the dropping. I'm running filebeat 7.15 on rhel-7. First tack i tried was to use the internal monitorings sys… --- ## [Discrepancy (bug or misunderstanding) in how simple\_query\_string handles queries?](https://discuss.elastic.co/t/discrepancy-bug-or-misunderstanding-in-how-simple-query-string-handles-queries/299351)
**Author:** [@ndtreviv](https://discuss.elastic.co/u/ndtreviv)\ **Replies:** 2\ **Last updated:** [March 14, 2022, 9:52am UTC](https://discuss.elastic.co/t/discrepancy-bug-or-misunderstanding-in-how-simple-query-string-handles-queries/299351 "2022-03-14T09:52:22Z")
I have a field, let's call it MyField mapped as a keyword type. If I search using simple\_query\_string, like so: GET /my-index/\_search { "from": 0, "size": 1000, "query": { "bool": { "filter": \[ … --- ## [Couldn't run filebeat image](https://discuss.elastic.co/t/couldnt-run-filebeat-image/299590)
**Author:** [@Mariem](https://discuss.elastic.co/u/Mariem)\ **Replies:** 1\ **Last updated:** [March 14, 2022, 8:36am UTC](https://discuss.elastic.co/t/couldnt-run-filebeat-image/299590 "2022-03-14T08:36:38Z")
Can someone help me solve this problem --- ## [HTTP Output Could not fetch url (Illegal character)](https://discuss.elastic.co/t/http-output-could-not-fetch-url-illegal-character/299439)
**Author:** [@josemariafrupm](https://discuss.elastic.co/u/josemariafrupm)\ **Replies:** 2\ **Last updated:** [March 14, 2022, 8:23am UTC](https://discuss.elastic.co/t/http-output-could-not-fetch-url-illegal-character/299439 "2022-03-14T08:23:58Z")
Hi! I'm an university student working on his final degree project, and I can't find any info about the problem I'm having. I need to send logs through Logstash with http but it says it can't fetch the url. I think the pr… --- ## [Elasticsearch 8 disable BEGIN SECURITY AUTO CONFIGURATION](https://discuss.elastic.co/t/elasticsearch-8-disable-begin-security-auto-configuration/299507)
**Author:** [@VamPikmin](https://discuss.elastic.co/u/VamPikmin)\ **Replies:** 2\ **Last updated:** [March 14, 2022, 7:52am UTC](https://discuss.elastic.co/t/elasticsearch-8-disable-begin-security-auto-configuration/299507 "2022-03-14T07:52:00Z")
Is there a way to disable this during install? or even have a yes and no option I'm trying to create an automated install with my own certificates and sometimes during testing I don't want to have user authentication en… --- ## [Is it possible to update Elasticsearch using logstash conf file with field other than document id](https://discuss.elastic.co/t/is-it-possible-to-update-elasticsearch-using-logstash-conf-file-with-field-other-than-document-id/299203)
**Author:** [@RAM\_NATHAN](https://discuss.elastic.co/u/RAM_NATHAN)\ **Replies:** 1\ **Last updated:** [March 14, 2022, 3:52am UTC](https://discuss.elastic.co/t/is-it-possible-to-update-elasticsearch-using-logstash-conf-file-with-field-other-than-document-id/299203 "2022-03-14T03:52:21Z")
Hello if\[sid\]!="null" and \[sid\]!="" { elasticsearch { hosts =\> \["localhost:9200"\] document\_id =\> "%{sid}" index =\> "dashboard\_write" … --- ## [Can I create a Visualization from two different indices?](https://discuss.elastic.co/t/can-i-create-a-visualization-from-two-different-indices/299556)
**Author:** [@Blason](https://discuss.elastic.co/u/Blason)\ **Replies:** 3\ **Last updated:** [March 14, 2022, 3:06am UTC](https://discuss.elastic.co/t/can-i-create-a-visualization-from-two-different-indices/299556 "2022-03-14T03:06:50Z")
Hi Team, I wanted to plot a data in a table and need to pick up a fields from different indices. Can that be possible with Kibana? If not then any other alternatives you can think of? --- ## [How to fix kafka fatal error when running](https://discuss.elastic.co/t/how-to-fix-kafka-fatal-error-when-running/299582)
**Author:** [@leyleynewt](https://discuss.elastic.co/u/leyleynewt)\ **Replies:** 1\ **Last updated:** [March 14, 2022, 2:48am UTC](https://discuss.elastic.co/t/how-to-fix-kafka-fatal-error-when-running/299582 "2022-03-14T02:48:39Z")
Please see screenshots below: Thanks in advance!!! --- ## [How to curl this query to shell script](https://discuss.elastic.co/t/how-to-curl-this-query-to-shell-script/299292)
**Author:** [@leyleynewt](https://discuss.elastic.co/u/leyleynewt)\ **Replies:** 4\ **Last updated:** [March 14, 2022, 2:30am UTC](https://discuss.elastic.co/t/how-to-curl-this-query-to-shell-script/299292 "2022-03-14T02:30:03Z")
I want to delete the 5 days old data of all my indexes. How to curl this query to shell script POST \_all/\_delete\_by\_query { "query": { "range": { "@timestamp": { "lte": "now-5d" } } } } Than… --- ## [How to convert KQL to curl command in bash](https://discuss.elastic.co/t/how-to-convert-kql-to-curl-command-in-bash/299207)
**Author:** [@leyleynewt](https://discuss.elastic.co/u/leyleynewt)\ **Replies:** 4\ **Last updated:** [March 14, 2022, 2:26am UTC](https://discuss.elastic.co/t/how-to-convert-kql-to-curl-command-in-bash/299207 "2022-03-14T02:26:18Z")
How can I run this KQL in the bash command POST \_all/\_delete\_by\_query { "query": { "range": { "@timestamp": { "lte": "now-5d" } } } } Thank you in advance! --- ## [NetApp reports Elasticsearch High Latency alerts](https://discuss.elastic.co/t/netapp-reports-elasticsearch-high-latency-alerts/299570)
**Author:** [@KrishnaCh](https://discuss.elastic.co/u/KrishnaCh)\ **Replies:** 0\ **Last updated:** [March 13, 2022, 5:20pm UTC](https://discuss.elastic.co/t/netapp-reports-elasticsearch-high-latency-alerts/299570 "2022-03-13T17:20:27Z")
Hi All, We have NetApp storage in our environment. And there is one cluster which is hardly being used by the application, and there is very minimal data traffic coming into this cluster We are using Zabbix monitoring … --- ## [Logstash output using environment variable](https://discuss.elastic.co/t/logstash-output-using-environment-variable/299569)
**Author:** [@Amit\_Halle](https://discuss.elastic.co/u/Amit_Halle)\ **Replies:** 1\ **Last updated:** [March 13, 2022, 4:23pm UTC](https://discuss.elastic.co/t/logstash-output-using-environment-variable/299569 "2022-03-13T16:23:02Z")
hi I'm trying to send my logs to an additional output when a certain field's value is a member in a given list. The way I go about this is wrapping the additional output part in the pipeline with an "if" condition and … --- ## [Collapse results by multipli fields( highRestClient java](https://discuss.elastic.co/t/collapse-results-by-multipli-fields-highrestclient-java/298740)
**Author:** [@Anna\_Kuranda](https://discuss.elastic.co/u/Anna_Kuranda)\ **Replies:** 4\ **Last updated:** [March 13, 2022, 2:26pm UTC](https://discuss.elastic.co/t/collapse-results-by-multipli-fields-highrestclient-java/298740 "2022-03-13T14:26:06Z")
Hi I need do collapse by two fields :field1 and field2 I use java collapse by field1 searchSourceBuilder.collapse(new CollapseBuilder("field1").setInnerHits(innerHitBuilder)); In my case I need additional colla… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1014) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1016)