# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1100 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1101 --- ## [Connection elastic Cloud - Premise](https://discuss.elastic.co/t/connection-elastic-cloud-premise/293953)
**Author:** [@Kirtash](https://discuss.elastic.co/u/Kirtash)\ **Replies:** 0\ **Last updated:** [January 10, 2022, 10:45pm UTC](https://discuss.elastic.co/t/connection-elastic-cloud-premise/293953 "2022-01-10T22:45:11Z")
Good morning! I changed the Elastic cloud on premise to cloud and know I have a question about the security. The problem is that I have a service on premise of redis, and I would like add the integration in elastic Clou… --- ## [Logstash S3 output requires bucket object permissions at the root of the bucket, regardless of prefix config](https://discuss.elastic.co/t/logstash-s3-output-requires-bucket-object-permissions-at-the-root-of-the-bucket-regardless-of-prefix-config/293951)
**Author:** [@mdebord](https://discuss.elastic.co/u/mdebord)\ **Replies:** 0\ **Last updated:** [January 10, 2022, 10:30pm UTC](https://discuss.elastic.co/t/logstash-s3-output-requires-bucket-object-permissions-at-the-root-of-the-bucket-regardless-of-prefix-config/293951 "2022-01-10T22:30:54Z")
Logstash requires write access to the root of the bucket, regardless of the prefix defined in config. There are a few issues to note with this behavior: Logstash should be isolating its work into the defined prefix p… --- ## [Filebeat cannot detect modified ingested files](https://discuss.elastic.co/t/filebeat-cannot-detect-modified-ingested-files/293837)
**Author:** [@park\_rage](https://discuss.elastic.co/u/park_rage)\ **Replies:** 4\ **Last updated:** [January 10, 2022, 10:04pm UTC](https://discuss.elastic.co/t/filebeat-cannot-detect-modified-ingested-files/293837 "2022-01-10T22:04:23Z")
I am configuring the ELK + filebeat environment using docker-compose , but the environment and configuration are as follows. Environment: MacOS Functions to be implemented: Collect the /Users/mymac/dev/logs/app.log… --- ## [Test Elastic Search Cross Cluster Replication in terms of latency and data loss](https://discuss.elastic.co/t/test-elastic-search-cross-cluster-replication-in-terms-of-latency-and-data-loss/293892)
**Author:** [@prasadnewase](https://discuss.elastic.co/u/prasadnewase)\ **Replies:** 1\ **Last updated:** [January 10, 2022, 9:57pm UTC](https://discuss.elastic.co/t/test-elastic-search-cross-cluster-replication-in-terms-of-latency-and-data-loss/293892 "2022-01-10T21:57:05Z")
How to check replication latency and data loss in the Cross Cluster Replication of Elasticsearch? When we implement CCR how we can ensure the accuracy and efficiency of the replication. Please suggest any tool or .Net cl… --- ## [Evacuate node for maintenance](https://discuss.elastic.co/t/evacuate-node-for-maintenance/293914)
**Author:** [@windows95](https://discuss.elastic.co/u/windows95)\ **Replies:** 1\ **Last updated:** [January 10, 2022, 9:54pm UTC](https://discuss.elastic.co/t/evacuate-node-for-maintenance/293914 "2022-01-10T21:54:54Z")
Hi, when I have a 3 node cluster and and 3 shards (1 primary, 2 replica) per index, as to my experience it is not possible to evacuate a node completely, which makes sense to me. Is it safe in this case to stop Elastics… --- ## [If i have large amount of data, should i create multi data stream instead of a single data stream](https://discuss.elastic.co/t/if-i-have-large-amount-of-data-should-i-create-multi-data-stream-instead-of-a-single-data-stream/293609)
**Author:** [@Zephery\_Wen](https://discuss.elastic.co/u/Zephery_Wen)\ **Replies:** 2\ **Last updated:** [January 10, 2022, 9:14pm UTC](https://discuss.elastic.co/t/if-i-have-large-amount-of-data-should-i-create-multi-data-stream-instead-of-a-single-data-stream/293609 "2022-01-10T21:14:21Z")
If the storage capacity is about several Trillionbyte, should i use a single data stream? like this: data stream aaa contains index:aaa-2022.01.06-0001,aaa-2022.01.06-0002,aaa-2022.01.07-0003 or several data stream d… --- ## [Monthly indices but ILM on daily basis](https://discuss.elastic.co/t/monthly-indices-but-ilm-on-daily-basis/293458)
**Author:** [@windows95](https://discuss.elastic.co/u/windows95)\ **Replies:** 6\ **Last updated:** [January 10, 2022, 9:06pm UTC](https://discuss.elastic.co/t/monthly-indices-but-ilm-on-daily-basis/293458 "2022-01-10T21:06:52Z")
Hello. I had daily indices and a fixed retention time of 365 days via ILM. Now I changed to monthly indices to increase the index size. The problem now is that when the oldest index will be deleted, all data from now-(3… --- ## [Log4j CVE-2021-44832 (released 28th dec) - is ES vulnerable?](https://discuss.elastic.co/t/log4j-cve-2021-44832-released-28th-dec-is-es-vulnerable/293076)
**Author:** [@Vashiru](https://discuss.elastic.co/u/Vashiru)\ **Replies:** 9\ **Last updated:** [January 10, 2022, 9:04pm UTC](https://discuss.elastic.co/t/log4j-cve-2021-44832-released-28th-dec-is-es-vulnerable/293076 "2022-01-10T21:04:20Z")
As the title states, is Elasticsearch vulnerable for the new Log4j vulnerability CVE-2021-44832? This is a new vulnerability of which the details were released a few hours ago. Or is this prevented by the security manage… --- ## [Question about release scheduling](https://discuss.elastic.co/t/question-about-release-scheduling/293926)
**Author:** [@Miguel\_Lopez1](https://discuss.elastic.co/u/Miguel_Lopez1)\ **Replies:** 1\ **Last updated:** [January 10, 2022, 9:01pm UTC](https://discuss.elastic.co/t/question-about-release-scheduling/293926 "2022-01-10T21:01:54Z")
Hi, As part of a masters degree assignment we need to address some questions about the Elasticsearch to the developers. The question is: How are the release schedule planned in relation to deciding when to increase a … --- ## [Kibana Dashboard Template for ECS](https://discuss.elastic.co/t/kibana-dashboard-template-for-ecs/293656)
**Author:** [@lucas.sampaio](https://discuss.elastic.co/u/lucas.sampaio)\ **Replies:** 1\ **Last updated:** [January 10, 2022, 8:57pm UTC](https://discuss.elastic.co/t/kibana-dashboard-template-for-ecs/293656 "2022-01-10T20:57:11Z")
Is there a dashboard template that follows the ECS specifications? ty. --- ## [Logstash Servers Stopping Each Others Logging](https://discuss.elastic.co/t/logstash-servers-stopping-each-others-logging/293784)
**Author:** [@daniel.talbot](https://discuss.elastic.co/u/daniel.talbot)\ **Replies:** 4\ **Last updated:** [January 10, 2022, 8:56pm UTC](https://discuss.elastic.co/t/logstash-servers-stopping-each-others-logging/293784 "2022-01-10T20:56:40Z")
Hi all, Currently I am troubleshooting a configuration that is working in our prod environment but not in our development environment. We are running multiple servers in Dev so I am testing changes on one while I let t… --- ## [Drop previous csv lines if field value already exists](https://discuss.elastic.co/t/drop-previous-csv-lines-if-field-value-already-exists/293947)
**Author:** [@Micah\_Barsness](https://discuss.elastic.co/u/Micah_Barsness)\ **Replies:** 1\ **Last updated:** [January 10, 2022, 8:55pm UTC](https://discuss.elastic.co/t/drop-previous-csv-lines-if-field-value-already-exists/293947 "2022-01-10T20:55:38Z")
I'd like to know if there is a way to drop/overwrite previous csv documents if a field value already exists. In my screenshot above globalCallID is what I want to match on. Take globalCallID\_callID number 263504... … --- ## [No host logs displayed within Fleet app](https://discuss.elastic.co/t/no-host-logs-displayed-within-fleet-app/293935)
**Author:** [@agentw](https://discuss.elastic.co/u/agentw)\ **Replies:** 1\ **Last updated:** [January 10, 2022, 7:47pm UTC](https://discuss.elastic.co/t/no-host-logs-displayed-within-fleet-app/293935 "2022-01-10T19:47:21Z")
Fleet is not displaying host logs when clicking individual Elastic Agents in the Fleet panel. No results are found when clicking 'Open in Logs' on the Agent page (Observability \> Logs (Stream) app). If I remove the filte… --- ## [Filebeat Module O365 API URI?](https://discuss.elastic.co/t/filebeat-module-o365-api-uri/293471)
**Author:** [@elasticband](https://discuss.elastic.co/u/elasticband)\ **Replies:** 5\ **Last updated:** [January 10, 2022, 7:23pm UTC](https://discuss.elastic.co/t/filebeat-module-o365-api-uri/293471 "2022-01-10T19:23:15Z")
I am trying to get some support from Microsoft because I am not seeing all the login data I see in the Azure AD Console via the O365 Module. They would like to know what URI the module is using for API calls and I am not… --- ## [Filebeat duplicates events after restart](https://discuss.elastic.co/t/filebeat-duplicates-events-after-restart/293917)
**Author:** [@pilincom](https://discuss.elastic.co/u/pilincom)\ **Replies:** 0\ **Last updated:** [January 10, 2022, 5:07pm UTC](https://discuss.elastic.co/t/filebeat-duplicates-events-after-restart/293917 "2022-01-10T17:07:51Z")
I'm using Filebeat 7.16.2 to ship logs to Logstash -\> ES. For some reason every time I restart filebeat service, it scans all files in the log directory again and sends them to logstash. registry directory is accessible… --- ## [Boosting Boolean Should's & Best Approach for Address](https://discuss.elastic.co/t/boosting-boolean-shoulds-best-approach-for-address/293916)
**Author:** [@snoopy20](https://discuss.elastic.co/u/snoopy20)\ **Replies:** 0\ **Last updated:** [January 10, 2022, 5:06pm UTC](https://discuss.elastic.co/t/boosting-boolean-shoulds-best-approach-for-address/293916 "2022-01-10T17:06:25Z")
Hi, Couldn't find anything in the documentation about how do you go about boosting an individual should match? I'd hoped it would be a simple case of adding the boost: n into the object as with multi\_search but it's not… --- ## [Maps showing incorrect data](https://discuss.elastic.co/t/maps-showing-incorrect-data/293137)
**Author:** [@bm11100](https://discuss.elastic.co/u/bm11100)\ **Replies:** 9\ **Last updated:** [January 10, 2022, 4:02pm UTC](https://discuss.elastic.co/t/maps-showing-incorrect-data/293137 "2022-01-10T16:02:17Z")
Hello, I'm using the o365 integration and want to save a map of source login locations. When I edit the map, the data is correct, see below Once the map is saved, the data is incorrect, it has many more data points… --- ## [Count over Time](https://discuss.elastic.co/t/count-over-time/293653)
**Author:** [@BoKu](https://discuss.elastic.co/u/BoKu)\ **Replies:** 11\ **Last updated:** [January 10, 2022, 3:56pm UTC](https://discuss.elastic.co/t/count-over-time/293653 "2022-01-10T15:56:23Z")
Hello and a happy new year, i ingest the Transports Logs from several Exchange Server via Logstash into Elastic. I'd like to count the TOP 10 Sender Adresses and TOP 10 Recipient Adresses in a given Timerange, like the… --- ## [How does we can implement ingest pipeline in runtime](https://discuss.elastic.co/t/how-does-we-can-implement-ingest-pipeline-in-runtime/293830)
**Author:** [@kadiveti](https://discuss.elastic.co/u/kadiveti)\ **Replies:** 2\ **Last updated:** [January 10, 2022, 3:44pm UTC](https://discuss.elastic.co/t/how-does-we-can-implement-ingest-pipeline-in-runtime/293830 "2022-01-10T15:44:15Z")
Hi Team, I created a ingest pipeline like below. PUT \_ingest/pipeline/test2 { "description": "Test the pipe line", "processors": \[ { "remove": { "field": "account\_number" }, "set": { "field": "\_source.fullname… --- ## [From visState to raw aggregations request](https://discuss.elastic.co/t/from-visstate-to-raw-aggregations-request/293465)
**Author:** [@Nicolap](https://discuss.elastic.co/u/Nicolap)\ **Replies:** 2\ **Last updated:** [January 10, 2022, 3:43pm UTC](https://discuss.elastic.co/t/from-visstate-to-raw-aggregations-request/293465 "2022-01-10T15:43:18Z")
Hi all, I'm trying to create an aggregation request from a visstate of a visualize (mainly from a data table). I'm searching in the kibana code but didn't find anything... What I want to do is to get the same result o… --- ## [Hello, I wanted output like attched tableau in kibana..but I am getting something different onlywhat to do? Please help me on this](https://discuss.elastic.co/t/hello-i-wanted-output-like-attched-tableau-in-kibana-but-i-am-getting-something-different-onlywhat-to-do-please-help-me-on-this/293814)
**Author:** [@swati\_pal](https://discuss.elastic.co/u/swati_pal)\ **Replies:** 1\ **Last updated:** [January 10, 2022, 3:37pm UTC](https://discuss.elastic.co/t/hello-i-wanted-output-like-attched-tableau-in-kibana-but-i-am-getting-something-different-onlywhat-to-do-please-help-me-on-this/293814 "2022-01-10T15:37:43Z")
--- ## [\[7.15\] Kibana plugin development - Import saved objects to specific space](https://discuss.elastic.co/t/7-15-kibana-plugin-development-import-saved-objects-to-specific-space/293869)
**Author:** [@Fabio-sama](https://discuss.elastic.co/u/Fabio-sama)\ **Replies:** 4\ **Last updated:** [January 10, 2022, 3:18pm UTC](https://discuss.elastic.co/t/7-15-kibana-plugin-development-import-saved-objects-to-specific-space/293869 "2022-01-10T15:18:17Z")
Hi there, my team and I are developing a custom Kibana plugin and during the initialization phase we'd like to import some custom Saved Objects into a new space. Basically, we managed to create the space during the ini… --- ## [Document delete spike in elastic v7](https://discuss.elastic.co/t/document-delete-spike-in-elastic-v7/293903)
**Author:** [@Idan\_Koch](https://discuss.elastic.co/u/Idan_Koch)\ **Replies:** 0\ **Last updated:** [January 10, 2022, 3:03pm UTC](https://discuss.elastic.co/t/document-delete-spike-in-elastic-v7/293903 "2022-01-10T15:03:32Z")
Hi, Recently we are upgrading from Elasticsearch v6 to Elasticsearch v7 we are basically doing the same thing but we see that we have huge spikes in document deleted (unlike v6) and that IOPS are higher 10x can you pl… --- ## [Disaster Recovery - Non-Enterprise version](https://discuss.elastic.co/t/disaster-recovery-non-enterprise-version/293897)
**Author:** [@rajeev.j.khanna](https://discuss.elastic.co/u/rajeev.j.khanna)\ **Replies:** 1\ **Last updated:** [January 10, 2022, 2:50pm UTC](https://discuss.elastic.co/t/disaster-recovery-non-enterprise-version/293897 "2022-01-10T14:50:06Z")
Hi Team, We are using the open-source version of ELK. We want to implement a Disaster Recovery (DR) solution for our application. That means ELK LOGS has to be replicated. How can we do this? (Please do not share the… --- ## [Time series graph that summarizes the index state for each time point](https://discuss.elastic.co/t/time-series-graph-that-summarizes-the-index-state-for-each-time-point/293660)
**Author:** [@Janujc](https://discuss.elastic.co/u/Janujc)\ **Replies:** 4\ **Last updated:** [January 10, 2022, 2:32pm UTC](https://discuss.elastic.co/t/time-series-graph-that-summarizes-the-index-state-for-each-time-point/293660 "2022-01-10T14:32:55Z")
Hello, I'm currently trying to solve the following problem: We have users that are active from the date when they start a certain action to the date when they complete it. We need to display a graph showing the number … --- ## [Multiple custom navLinks Kibana 7.15](https://discuss.elastic.co/t/multiple-custom-navlinks-kibana-7-15/293858)
**Author:** [@Osysh](https://discuss.elastic.co/u/Osysh)\ **Replies:** 3\ **Last updated:** [January 10, 2022, 1:50pm UTC](https://discuss.elastic.co/t/multiple-custom-navlinks-kibana-7-15/293858 "2022-01-10T13:50:47Z")
Hi, I try to add multiple custom nav link under a new category in the kibana menu. I used the setCustomNavLink function but it allows you only to add one menu item only. Is there another solution ? Regards --- ## [Scale monitoring using metricbeat](https://discuss.elastic.co/t/scale-monitoring-using-metricbeat/293891)
**Author:** [@motkele](https://discuss.elastic.co/u/motkele)\ **Replies:** 3\ **Last updated:** [January 10, 2022, 1:46pm UTC](https://discuss.elastic.co/t/scale-monitoring-using-metricbeat/293891 "2022-01-10T13:46:04Z")
Hello, I have a very specific question regarding the way to collect metrics using metricbeat. I would like to collect the metrics from all the services running on the server (and for which a metricbeat module is availa… --- ## [How to sync elasticsearch data between DC, DR](https://discuss.elastic.co/t/how-to-sync-elasticsearch-data-between-dc-dr/293651)
**Author:** [@banf](https://discuss.elastic.co/u/banf)\ **Replies:** 6\ **Last updated:** [January 10, 2022, 1:41pm UTC](https://discuss.elastic.co/t/how-to-sync-elasticsearch-data-between-dc-dr/293651 "2022-01-10T13:41:24Z")
Hi Team, We have elasticsearch running on our DC side so standalone as of now. We would like to know how can we sync elasticsearch data to DR side so that if DR happens, we can still see data in kibana. It is installe… --- ## [Metricbeat showing "server's certificate chain verification is disabled"](https://discuss.elastic.co/t/metricbeat-showing-servers-certificate-chain-verification-is-disabled/287759)
**Author:** [@gboer](https://discuss.elastic.co/u/gboer)\ **Replies:** 9\ **Last updated:** [January 10, 2022, 1:38pm UTC](https://discuss.elastic.co/t/metricbeat-showing-servers-certificate-chain-verification-is-disabled/287759 "2022-01-10T13:38:14Z")
Hello, As far as I can see, I've set up Metricbeat to correctly validate/use SSL, but it still gives the following warning when running 'metricbeat test output': server's certificate chain verification is disabled My … --- ## [FIlebeat IIS module](https://discuss.elastic.co/t/filebeat-iis-module/293257)
**Author:** [@rckvwijk](https://discuss.elastic.co/u/rckvwijk)\ **Replies:** 11\ **Last updated:** [January 10, 2022, 1:31pm UTC](https://discuss.elastic.co/t/filebeat-iis-module/293257 "2022-01-10T13:31:31Z")
Hi there, We're using filebeat with great succes for most of our logging but we've received a new request from within the organisation. They want to ingest the IIS logs from our Windows Server 2016 machine but even thou… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1099) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1101)