# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1156 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1157 --- ## [I am confused on backup and restore process, can someone please help?](https://discuss.elastic.co/t/i-am-confused-on-backup-and-restore-process-can-someone-please-help/289729)
**Author:** [@Blason](https://discuss.elastic.co/u/Blason)\ **Replies:** 2\ **Last updated:** [November 20, 2021, 4:05am UTC](https://discuss.elastic.co/t/i-am-confused-on-backup-and-restore-process-can-someone-please-help/289729 "2021-11-20T04:05:14Z")
Hi Team, I have single node elastic cluster and my indices are getting created everyday. I do close them manually every after 120 days. So once index is closed would it be possible to take a a backup of those? Or is the… --- ## [New to Logstash - can't get it to connect to my Elasticsearch](https://discuss.elastic.co/t/new-to-logstash-cant-get-it-to-connect-to-my-elasticsearch/289727)
**Author:** [@aluminex](https://discuss.elastic.co/u/aluminex)\ **Replies:** 1\ **Last updated:** [November 20, 2021, 3:28am UTC](https://discuss.elastic.co/t/new-to-logstash-cant-get-it-to-connect-to-my-elasticsearch/289727 "2021-11-20T03:28:55Z")
I have Elasticsearch and Kibana on a different host. I'm trying to get my Logstash instance to output to Elasticsearch on a remote host. I can forward my logs to Filebeat and then to Elastic, but I am trying to write/t… --- ## [Faile to start Elasticsearch 7.12.1](https://discuss.elastic.co/t/faile-to-start-elasticsearch-7-12-1/289718)
**Author:** [@tranha31](https://discuss.elastic.co/u/tranha31)\ **Replies:** 2\ **Last updated:** [November 20, 2021, 1:27am UTC](https://discuss.elastic.co/t/faile-to-start-elasticsearch-7-12-1/289718 "2021-11-20T01:27:05Z")
I install vietnamese-analysis for Elasticsearch 7.12.1. But when I restart Elasticsearch, I get the following error: \[2021-11-20T01:56:57,505\]\[ERROR\]\[o.e.b.ElasticsearchUncaughtExceptionHandler\] \[dell-Precision-M4800… --- ## [Elasticsearch Synonyms - can phrases be used?](https://discuss.elastic.co/t/elasticsearch-synonyms-can-phrases-be-used/289723)
**Author:** [@pmono](https://discuss.elastic.co/u/pmono)\ **Replies:** 0\ **Last updated:** [November 19, 2021, 11:08pm UTC](https://discuss.elastic.co/t/elasticsearch-synonyms-can-phrases-be-used/289723 "2021-11-19T23:08:08Z")
Howdy, is it possible to use Phrase Synonyms for indexing? We had issues on ES 7.8 where it would crash indexing. We recently switched to 7.13.2. Are there any changes in terms of synonyms? Can phrases be used? Examp… --- ## [Tuning queries](https://discuss.elastic.co/t/tuning-queries/289721)
**Author:** [@Nick\_Hatfield](https://discuss.elastic.co/u/Nick_Hatfield)\ **Replies:** 0\ **Last updated:** [November 19, 2021, 10:50pm UTC](https://discuss.elastic.co/t/tuning-queries/289721 "2021-11-19T22:50:38Z")
Hey gang is there anyone that can help me with an Elasticsearch query? I'm trying to make the query more efficient by returning only unique hits. My query is structured like this currently: { "query": { "bool":… --- ## [Kibana not showing recent Elasticsearch data](https://discuss.elastic.co/t/kibana-not-showing-recent-elasticsearch-data/289647)
**Author:** [@sanjpatil](https://discuss.elastic.co/u/sanjpatil)\ **Replies:** 2\ **Last updated:** [November 19, 2021, 10:24pm UTC](https://discuss.elastic.co/t/kibana-not-showing-recent-elasticsearch-data/289647 "2021-11-19T22:24:30Z")
Hello, We observed kibana stopped showing recent ES data from 31st October. If i query Elasticsearch index it has all the data its just not displaying on the dashboard. Can some one help with this ? Elasticsearch versi… --- ## [How to monitor events in chain or to detect if transaction was completed or not](https://discuss.elastic.co/t/how-to-monitor-events-in-chain-or-to-detect-if-transaction-was-completed-or-not/289596)
**Author:** [@sagarseth](https://discuss.elastic.co/u/sagarseth)\ **Replies:** 1\ **Last updated:** [November 19, 2021, 9:08pm UTC](https://discuss.elastic.co/t/how-to-monitor-events-in-chain-or-to-detect-if-transaction-was-completed-or-not/289596 "2021-11-19T21:08:54Z")
Hello Friends, lets imagine i have following state , i get a message ordered timeStamp1,transactionA,Status\_ordered I want to check if for this transaction if the order was delivered in the next 15 mins or not,, if no… --- ## [How can I delete remote index via Kibana's "Index Management" feature?](https://discuss.elastic.co/t/how-can-i-delete-remote-index-via-kibanas-index-management-feature/289719)
**Author:** [@jwmocs](https://discuss.elastic.co/u/jwmocs)\ **Replies:** 0\ **Last updated:** [November 19, 2021, 8:34pm UTC](https://discuss.elastic.co/t/how-can-i-delete-remote-index-via-kibanas-index-management-feature/289719 "2021-11-19T20:34:39Z")
Is it possible to remove old index data on a remote cluster using Kibana? I can delete indices on the local cluster fine in Kibana UI, but do I have to resort to the API to do the same for indices on a remote cluster? --- ## [Apply best\_compression to save disk space](https://discuss.elastic.co/t/apply-best-compression-to-save-disk-space/289705)
**Author:** [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Replies:** 2\ **Last updated:** [November 19, 2021, 7:27pm UTC](https://discuss.elastic.co/t/apply-best-compression-to-save-disk-space/289705 "2021-11-19T19:27:41Z")
Hi All, We are struggling with disk space issues on the Elasticsearch nodes. I came across the best\_compression option and the suggested way is as follows using dev tools: 1. Close all indices: POST \_all/\_close 2. A… --- ## [Kibana log to cloud storage](https://discuss.elastic.co/t/kibana-log-to-cloud-storage/289692)
**Author:** [@aditi\_salunke](https://discuss.elastic.co/u/aditi_salunke)\ **Replies:** 1\ **Last updated:** [November 19, 2021, 7:04pm UTC](https://discuss.elastic.co/t/kibana-log-to-cloud-storage/289692 "2021-11-19T19:04:43Z")
Hello, Can we have direct connectivity to upload kibana.log file after reaching to specific size of file to cloud storage? Or Can we specify cloud uploading path in kibana.yml itself for log.path setting? Because aft… --- ## [Logstash rewrite value for the same key instead of append](https://discuss.elastic.co/t/logstash-rewrite-value-for-the-same-key-instead-of-append/289702)
**Author:** [@ddoroshenko](https://discuss.elastic.co/u/ddoroshenko)\ **Replies:** 1\ **Last updated:** [November 19, 2021, 6:30pm UTC](https://discuss.elastic.co/t/logstash-rewrite-value-for-the-same-key-instead-of-append/289702 "2021-11-19T18:30:08Z")
Hello! I'm trying to parse CheckPoint log which contains data like this \_\_policy\_id\_tag:"product=APP1 & APP2\[db\_tag={ABCDEF};mgmt=abcd;date=123456789;policy\_name=foo\]";product:"APP3" I use the filter filter { kv { … --- ## [Add json object](https://discuss.elastic.co/t/add-json-object/289682)
**Author:** [@Roberto\_B](https://discuss.elastic.co/u/Roberto_B)\ **Replies:** 1\ **Last updated:** [November 19, 2021, 6:08pm UTC](https://discuss.elastic.co/t/add-json-object/289682 "2021-11-19T18:08:15Z")
Hi there, I would like to add a field liek this: field : {sub1 : null} which is the best way to do that? Kind Regards Roberto --- ## [Logstash information](https://discuss.elastic.co/t/logstash-information/289595)
**Author:** [@tractor\_boy](https://discuss.elastic.co/u/tractor_boy)\ **Replies:** 3\ **Last updated:** [November 19, 2021, 6:00pm UTC](https://discuss.elastic.co/t/logstash-information/289595 "2021-11-19T18:00:55Z")
I am really struggling to understand the documentation, and as such cannot work out what I need to do to get logstash to work. So logstash arrives as a zip (Is there an msi?) But nothing configured. The documentation … --- ## [Painless max script size limit?](https://discuss.elastic.co/t/painless-max-script-size-limit/289707)
**Author:** [@Matt\_McGovern](https://discuss.elastic.co/u/Matt_McGovern)\ **Replies:** 2\ **Last updated:** [November 19, 2021, 5:58pm UTC](https://discuss.elastic.co/t/painless-max-script-size-limit/289707 "2021-11-19T17:58:14Z")
It used to be that the total size of a painless stored script was 16384, from a hard-coded system limit I've seen referenced before as MAXIMUM\_SOURCE\_LENGTH = 16384. I've run into the limit within the last few years and… --- ## [Can't find Pinned Search in Java high level rest client](https://discuss.elastic.co/t/cant-find-pinned-search-in-java-high-level-rest-client/289715)
**Author:** [@sutty100](https://discuss.elastic.co/u/sutty100)\ **Replies:** 0\ **Last updated:** [November 19, 2021, 5:40pm UTC](https://discuss.elastic.co/t/cant-find-pinned-search-in-java-high-level-rest-client/289715 "2021-11-19T17:40:56Z")
I can't seem to find in the Java High level rest client (7.15.2) the pinned search query type. It is not in the QueryBuilders object, am I missing something here or is this just not included in the high level rest client… --- ## [Getting logstash to run](https://discuss.elastic.co/t/getting-logstash-to-run/289673)
**Author:** [@tractor\_boy](https://discuss.elastic.co/u/tractor_boy)\ **Replies:** 1\ **Last updated:** [November 19, 2021, 5:37pm UTC](https://discuss.elastic.co/t/getting-logstash-to-run/289673 "2021-11-19T17:37:15Z")
I have downloaded the 7.15 version on logstash and unzipped. Unfortunately the lack of an installer leaves the solution in a non working state. My current - first - challenge is getting logstash to use the bundled jdk.… --- ## [Parsing issues](https://discuss.elastic.co/t/parsing-issues/289681)
**Author:** [@nickel43](https://discuss.elastic.co/u/nickel43)\ **Replies:** 1\ **Last updated:** [November 19, 2021, 5:32pm UTC](https://discuss.elastic.co/t/parsing-issues/289681 "2021-11-19T17:32:13Z")
Hello, I'm new to Elastic and trying to parse JSON files in order to have multiple fields, so that I can make statistics out of it in Kibana. Here is a sample: { "info": { "generated\_on": "2017-12-03 08:41… --- ## [Security dashboard user (7.15)](https://discuss.elastic.co/t/security-dashboard-user-7-15/289592)
**Author:** [@tractor\_boy](https://discuss.elastic.co/u/tractor_boy)\ **Replies:** 1\ **Last updated:** [November 19, 2021, 5:05pm UTC](https://discuss.elastic.co/t/security-dashboard-user-7-15/289592 "2021-11-19T17:05:14Z")
I have found some docs that suggests that I need to create a user that has access to spaces, and put my dashboard into that space. My issue here is that that documentation doesn't supply the how! Can someone point me t… --- ## [Kibana not ready yet error after upgrading from 7.6.1 to 7.15.2](https://discuss.elastic.co/t/kibana-not-ready-yet-error-after-upgrading-from-7-6-1-to-7-15-2/289696)
**Author:** [@3c3m](https://discuss.elastic.co/u/3c3m)\ **Replies:** 1\ **Last updated:** [November 19, 2021, 4:10pm UTC](https://discuss.elastic.co/t/kibana-not-ready-yet-error-after-upgrading-from-7-6-1-to-7-15-2/289696 "2021-11-19T16:10:03Z")
Hello, We upgraded our elastic stack to logstash, Elasticsearch and kibana from version 7.6.1 to 7.15.2 respectively. But we get Kibana server is not ready yet error in kibana interface. kibana service is running but … --- ## [Get a number und events per minute](https://discuss.elastic.co/t/get-a-number-und-events-per-minute/289217)
**Author:** [@bitnapper](https://discuss.elastic.co/u/bitnapper)\ **Replies:** 3\ **Last updated:** [November 19, 2021, 3:57pm UTC](https://discuss.elastic.co/t/get-a-number-und-events-per-minute/289217 "2021-11-19T15:57:35Z")
Hi, I tried to figure out how many documents come in per minute. I coulnt find anything useful in stack monitoring so I tried with kibana and failed. I built a query giving me the documents from last 90 days but I cant … --- ## [Logstash not sending syslog to elasticsearch](https://discuss.elastic.co/t/logstash-not-sending-syslog-to-elasticsearch/289020)
**Author:** [@MKirby](https://discuss.elastic.co/u/MKirby)\ **Replies:** 41\ **Last updated:** [November 19, 2021, 3:36pm UTC](https://discuss.elastic.co/t/logstash-not-sending-syslog-to-elasticsearch/289020 "2021-11-19T15:36:16Z")
Hello Elastic team. I have been asking tons of questions and have been slowly making my way through the final part of my ELK SIEM installation. I am running a small environment with Elasticsearch, Logstash and Kibana i… --- ## [Logstash Lookup Fields](https://discuss.elastic.co/t/logstash-lookup-fields/289357)
**Author:** [@John\_snow](https://discuss.elastic.co/u/John_snow)\ **Replies:** 35\ **Last updated:** [November 18, 2021, 6:30pm UTC](https://discuss.elastic.co/t/logstash-lookup-fields/289357 "2021-11-18T18:30:57Z")
i wanted to use a lookup table in Logstash to check if account id exisits in lookub table then it will grab the output location from the lookup file. e--g Lookup File account\_id, output\_location, secrets, 123, s3, abcde… --- ## [Winlogbeat NewProcessFields Function Missing Parent Process](https://discuss.elastic.co/t/winlogbeat-newprocessfields-function-missing-parent-process/289679)
**Author:** [@elkn00b](https://discuss.elastic.co/u/elkn00b)\ **Replies:** 1\ **Last updated:** [November 19, 2021, 3:12pm UTC](https://discuss.elastic.co/t/winlogbeat-newprocessfields-function-missing-parent-process/289679 "2021-11-19T15:12:14Z")
Hi Elastic Team, I'm writing to request an update to the winlogbeat Windows Security module to add the parent process ID value for Windows Security event 4688. Lines 2132 to 2142 handle field renames for parent/child p… --- ## [ILM Policy is not working](https://discuss.elastic.co/t/ilm-policy-is-not-working/289465)
**Author:** [@maltewhiite](https://discuss.elastic.co/u/maltewhiite)\ **Replies:** 4\ **Last updated:** [November 19, 2021, 3:00pm UTC](https://discuss.elastic.co/t/ilm-policy-is-not-working/289465 "2021-11-19T15:00:21Z")
I have an Index Lifecycle Management Policy using a Hot Phase with recommended defaults. So Roll over when an index is 30 days old or any primary shard reaches 50 gigabytes. I assume this means that the index is conv… --- ## [Global Ordinals execution hint](https://discuss.elastic.co/t/global-ordinals-execution-hint/289699)
**Author:** [@ananth](https://discuss.elastic.co/u/ananth)\ **Replies:** 0\ **Last updated:** [November 19, 2021, 2:42pm UTC](https://discuss.elastic.co/t/global-ordinals-execution-hint/289699 "2021-11-19T14:42:30Z")
Hi All, I went through all the global ordinal related blogs and previous questions such as Global ordinals performance and size on-heap" Whether execution\_hint = map will operate in segment-private ordinal space ? My … --- ## [Efficient filtering in custom plugin](https://discuss.elastic.co/t/efficient-filtering-in-custom-plugin/289697)
**Author:** [@mjanuszkiewicz-tt](https://discuss.elastic.co/u/mjanuszkiewicz-tt)\ **Replies:** 0\ **Last updated:** [November 19, 2021, 2:40pm UTC](https://discuss.elastic.co/t/efficient-filtering-in-custom-plugin/289697 "2021-11-19T14:40:37Z")
Hello, I'm writing a custom plugin that allows filtering/scoring using an external service. The overhead of calling the service is relatively high: filtering a single document takes 80ms, filtering 10k documents takes 1… --- ## [Send Filebeat Internal Monitoring Via Logstash](https://discuss.elastic.co/t/send-filebeat-internal-monitoring-via-logstash/289468)
**Author:** [@jceddy](https://discuss.elastic.co/u/jceddy)\ **Replies:** 4\ **Last updated:** [November 19, 2021, 2:22pm UTC](https://discuss.elastic.co/t/send-filebeat-internal-monitoring-via-logstash/289468 "2021-11-19T14:22:00Z")
Basic question: Is there a way to configure Filebeat Internal Monitoring via Logstash? I am trying to add monitoring for Filebeat running on some external systems, but can only send it via Logstash (not directly to Elas… --- ## [Rename field problem](https://discuss.elastic.co/t/rename-field-problem/289669)
**Author:** [@ddoroshenko](https://discuss.elastic.co/u/ddoroshenko)\ **Replies:** 2\ **Last updated:** [November 19, 2021, 2:12pm UTC](https://discuss.elastic.co/t/rename-field-problem/289669 "2021-11-19T14:12:09Z")
Hello! I have input data like "abc":"123";"def":"456";"ghi":"789" I use the following filter to parse data and rename "abc" field to "blabla" filter { kv { source =\> "message" field\_split =\> ";" value\_s… --- ## [Network metric when docker network is awsvpc](https://discuss.elastic.co/t/network-metric-when-docker-network-is-awsvpc/289687)
**Author:** [@mancausoft](https://discuss.elastic.co/u/mancausoft)\ **Replies:** 0\ **Last updated:** [November 19, 2021, 1:04pm UTC](https://discuss.elastic.co/t/network-metric-when-docker-network-is-awsvpc/289687 "2021-11-19T13:04:20Z")
I'm using metribeat running on ecs, and i can't get metrics from docker that use as network awsvpc. All docker that use bridge network are working fine. Configuration: module: docker enabled: true metricsets: conta… --- ## [How to get search results with exact matches sorted by popularity within themselves and then partial matches sorted by popularity within themselves?](https://discuss.elastic.co/t/how-to-get-search-results-with-exact-matches-sorted-by-popularity-within-themselves-and-then-partial-matches-sorted-by-popularity-within-themselves/289685)
**Author:** [@f3dd3rn](https://discuss.elastic.co/u/f3dd3rn)\ **Replies:** 0\ **Last updated:** [November 19, 2021, 12:49pm UTC](https://discuss.elastic.co/t/how-to-get-search-results-with-exact-matches-sorted-by-popularity-within-themselves-and-then-partial-matches-sorted-by-popularity-within-themselves/289685 "2021-11-19T12:49:06Z")
Hello Elastic community, I am new to Elasticsearch and feel lost as to how to accomplish this. I have tried a lot of different things, but was not able to accomplish this. Let me explain the expected search results wi… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1155) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1157)