# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1189 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1190 --- ## [Filebeat holding deleted files which consumes disk space in our production cluster very often, any permenant fix for this?](https://discuss.elastic.co/t/filebeat-holding-deleted-files-which-consumes-disk-space-in-our-production-cluster-very-often-any-permenant-fix-for-this/287560)
**Author:** [@swetha25](https://discuss.elastic.co/u/swetha25)\ **Replies:** 0\ **Last updated:** [October 25, 2021, 9:44am UTC](https://discuss.elastic.co/t/filebeat-holding-deleted-files-which-consumes-disk-space-in-our-production-cluster-very-often-any-permenant-fix-for-this/287560 "2021-10-25T09:44:54Z")
We don't want any data loss in the production cluster. And this issue is happening very often and we end up in almost full disk utilization every time. Kindly please help us with the solution. --- ## [Query optimization](https://discuss.elastic.co/t/query-optimization/287559)
**Author:** [@hadrienrsq](https://discuss.elastic.co/u/hadrienrsq)\ **Replies:** 0\ **Last updated:** [October 25, 2021, 9:43am UTC](https://discuss.elastic.co/t/query-optimization/287559 "2021-10-25T09:43:44Z")
Dear community, I am pretty brand new to Elasticsearch and am looking to perform some sort of two steps query on one index. Indeed, the items in the index have what we call a cli\_ID attribute, which I would like to pre-… --- ## [Fleet server in Kubernetes](https://discuss.elastic.co/t/fleet-server-in-kubernetes/286727)
**Author:** [@Dmitriy\_Esin](https://discuss.elastic.co/u/Dmitriy_Esin)\ **Replies:** 3\ **Last updated:** [October 25, 2021, 9:32am UTC](https://discuss.elastic.co/t/fleet-server-in-kubernetes/286727 "2021-10-25T09:32:36Z")
Hi all! I noticed that Elastic Agent has variables for containerized deployment if I run this command: ./elastic-agent container -h Can I deploy Fleet Server, for example in the Kubernetes cluster? I've tried to use… --- ## [Logstash Error](https://discuss.elastic.co/t/logstash-error/287404)
**Author:** [@Mudit\_Tripathi](https://discuss.elastic.co/u/Mudit_Tripathi)\ **Replies:** 5\ **Last updated:** [October 25, 2021, 9:22am UTC](https://discuss.elastic.co/t/logstash-error/287404 "2021-10-25T09:22:27Z")
Hi Guys, I have created a sample csv file with 3 columns and I am using to log the csv file into Elasticsearch using logstash. This is my logstash.conf input { file { path =\> "/Users/mudit.tripathi/Downloads/samplel… --- ## [Automatic deletion of old documents](https://discuss.elastic.co/t/automatic-deletion-of-old-documents/287297)
**Author:** [@x41lakazam](https://discuss.elastic.co/u/x41lakazam)\ **Replies:** 3\ **Last updated:** [October 25, 2021, 8:57am UTC](https://discuss.elastic.co/t/automatic-deletion-of-old-documents/287297 "2021-10-25T08:57:24Z")
Hi there, Is there a way to configure an index so that every document gets deleted once he is more than 90 days ? I saw a lot of topics that propose to use a delete query in a crontab job but that sounds very inefficie… --- ## [Elasticsearch WARN log : "message": "path: /.kibana\_task\_manager/\_search"](https://discuss.elastic.co/t/elasticsearch-warn-log-message-path-kibana-task-manager-search/287483)
**Author:** [@Farzad\_Ebrahimi](https://discuss.elastic.co/u/Farzad_Ebrahimi)\ **Replies:** 1\ **Last updated:** [October 25, 2021, 8:54am UTC](https://discuss.elastic.co/t/elasticsearch-warn-log-message-path-kibana-task-manager-search/287483 "2021-10-25T08:54:37Z")
Hi everyone, today we faced to this log with level WARN: {"type": "server", "timestamp": "2021-10-23T05:13:43,815Z", "level": "WARN", "component": "r.suppressed", "cluster.name": "elasticsearch\_cluster", "node.name": "… --- ## [BigQuery to Elasticsearch Self-Managed configuration](https://discuss.elastic.co/t/bigquery-to-elasticsearch-self-managed-configuration/287228)
**Author:** [@Mandark1990](https://discuss.elastic.co/u/Mandark1990)\ **Replies:** 10\ **Last updated:** [October 25, 2021, 8:52am UTC](https://discuss.elastic.co/t/bigquery-to-elasticsearch-self-managed-configuration/287228 "2021-10-25T08:52:41Z")
Hi All, Am trying to test out the steps given here: https://www.elastic.co/blog/ingest-data-directly-from-google-bigquery-into-elastic-using-google-dataflow As per the documentation it says the implementation flow rem… --- ## [Suggest Elasticsearch Cluster Configuration](https://discuss.elastic.co/t/suggest-elasticsearch-cluster-configuration/287551)
**Author:** [@Farzad\_Ebrahimi](https://discuss.elastic.co/u/Farzad_Ebrahimi)\ **Replies:** 2\ **Last updated:** [October 25, 2021, 8:30am UTC](https://discuss.elastic.co/t/suggest-elasticsearch-cluster-configuration/287551 "2021-10-25T08:30:20Z")
Is it possible to use several Elasticsearch nodes with Docker on one machine in production? Suppose the indexes are daily and their size is about 150 GB and the number of documents in each index is more than 15 million. … --- ## [Delete by query](https://discuss.elastic.co/t/delete-by-query/287322)
**Author:** [@Giovanni\_Di\_Lembo](https://discuss.elastic.co/u/Giovanni_Di_Lembo)\ **Replies:** 6\ **Last updated:** [October 25, 2021, 7:39am UTC](https://discuss.elastic.co/t/delete-by-query/287322 "2021-10-25T07:39:54Z")
Hi all, and sorry for my poor english. I need to build a delete by query request. My porpose is to delete 'activity' elements in 'activities' array where 'creationDate' is less than some date. My index mapping is { … --- ## [Filebeat and Logstash no send Logs](https://discuss.elastic.co/t/filebeat-and-logstash-no-send-logs/287292)
**Author:** [@roxasval](https://discuss.elastic.co/u/roxasval)\ **Replies:** 6\ **Last updated:** [October 25, 2021, 7:28am UTC](https://discuss.elastic.co/t/filebeat-and-logstash-no-send-logs/287292 "2021-10-25T07:28:22Z")
Hello to all I'm a newbie on Elasticsearch and I'm having some problems: I have a cluster of 2 Elasticsearch (but I do most things with one) and a separate kibana. I would like to retrieve logs from network devices an… --- ## [Installable plugin (Elastic cloud - ES 7.15)](https://discuss.elastic.co/t/installable-plugin-elastic-cloud-es-7-15/287325)
**Author:** [@puyash](https://discuss.elastic.co/u/puyash)\ **Replies:** 1\ **Last updated:** [October 25, 2021, 3:57am UTC](https://discuss.elastic.co/t/installable-plugin-elastic-cloud-es-7-15/287325 "2021-10-25T03:57:38Z")
Trying to add plugin (.zip) through the Extensions tool. But I can't choose "installable plugin". Says it is not supported by my subscription. No additional information and nothing in the documentation. Have tried all ti… --- ## [Elasticsearch P12 certs error](https://discuss.elastic.co/t/elasticsearch-p12-certs-error/287367)
**Author:** [@john\_99](https://discuss.elastic.co/u/john_99)\ **Replies:** 0\ **Last updated:** [October 21, 2021, 9:08pm UTC](https://discuss.elastic.co/t/elasticsearch-p12-certs-error/287367 "2021-10-21T21:08:40Z")
Hi Team, I am getting some errors while renewing the p12 certs. I followed the below steps: Ste: 1 cd /usr/share/Elasticsearch Step 2: ./bin/Elasticsearch-certutil ca Step 3: ./bin/Elasticsearch-certutil cert --ca e… --- ## [How to save One index field into another index?](https://discuss.elastic.co/t/how-to-save-one-index-field-into-another-index/287399)
**Author:** [@padamrai](https://discuss.elastic.co/u/padamrai)\ **Replies:** 1\ **Last updated:** [October 25, 2021, 3:54am UTC](https://discuss.elastic.co/t/how-to-save-one-index-field-into-another-index/287399 "2021-10-25T03:54:14Z")
I want to save SMS data in another field because I am getting the same SMS three times that's why to avoid duplication I used document\_id that is overriding the old with a new one but problem is that I am getting SMS dat… --- ## [Exiting: couldn't connect to any of the configured Elasticsearch hosts. Errors: \[error connecting to Elasticsearch at http://172.31.33.170:9200: Get "http://172.31.33.170:9200": net/http: request canceled while waiting for connection (Client.Timeout excee](https://discuss.elastic.co/t/exiting-couldnt-connect-to-any-of-the-configured-elasticsearch-hosts-errors-error-connecting-to-elasticsearch-at-http-172-31-33-170-get-http-172-31-33-170-9200-net-http-request-canceled-while-waiting-for-connection-client-timeout-excee/287391)
**Author:** [@chandra\_mohan1](https://discuss.elastic.co/u/chandra_mohan1)\ **Replies:** 1\ **Last updated:** [October 25, 2021, 3:53am UTC](https://discuss.elastic.co/t/exiting-couldnt-connect-to-any-of-the-configured-elasticsearch-hosts-errors-error-connecting-to-elasticsearch-at-http-172-31-33-170-get-http-172-31-33-170-9200-net-http-request-canceled-while-waiting-for-connection-client-timeout-excee/287391 "2021-10-25T03:53:30Z")
I am trying to send apache logs but when setup filebeat getting this error: Exiting: couldn't connect to any of the configured Elasticsearch hosts. Errors: \[error connecting to Elasticsearch at http://172.31.33.170:9200:… --- ## [Question with RestClientBuilder's default setting](https://discuss.elastic.co/t/question-with-restclientbuilders-default-setting/287528)
**Author:** [@finishne](https://discuss.elastic.co/u/finishne)\ **Replies:** 0\ **Last updated:** [October 25, 2021, 3:43am UTC](https://discuss.elastic.co/t/question-with-restclientbuilders-default-setting/287528 "2021-10-25T03:43:27Z")
Recently I ran into a problem. When accessing cluster at 2000qps, the service caused the local connection timeout due to the index warm-up. However, these connections created by the AsynHttpClient of RestHighLevelClient… --- ## [How To make my elasticsearch index smaller by field values?](https://discuss.elastic.co/t/how-to-make-my-elasticsearch-index-smaller-by-field-values/287471)
**Author:** [@dfang](https://discuss.elastic.co/u/dfang)\ **Replies:** 1\ **Last updated:** [October 25, 2021, 3:30am UTC](https://discuss.elastic.co/t/how-to-make-my-elasticsearch-index-smaller-by-field-values/287471 "2021-10-25T03:30:34Z")
I have setup ELK running fine. I have filebeat feeding log data via logstash then into Elasticsearch indice. This setup create one logstash index per-day . The challenge now is to find ways to break down the indices into… --- ## [Dashboard setup fails: Unable to bulk\_create index-pattern](https://discuss.elastic.co/t/dashboard-setup-fails-unable-to-bulk-create-index-pattern/287524)
**Author:** [@gunlomboy](https://discuss.elastic.co/u/gunlomboy)\ **Replies:** 0\ **Last updated:** [October 25, 2021, 3:03am UTC](https://discuss.elastic.co/t/dashboard-setup-fails-unable-to-bulk-create-index-pattern/287524 "2021-10-25T03:03:02Z")
Hi I have installed winlogbeat on a number of machines, and they are successfully shipping logs to Elasticsearch. However, when attempting to setup the dashboards either by setting the config in the winlogbeat.yml file… --- ## [What needs internet connectivity?](https://discuss.elastic.co/t/what-needs-internet-connectivity/287522)
**Author:** [@bevano](https://discuss.elastic.co/u/bevano)\ **Replies:** 0\ **Last updated:** [October 25, 2021, 2:13am UTC](https://discuss.elastic.co/t/what-needs-internet-connectivity/287522 "2021-10-25T02:13:24Z")
Hi All, I am trying to install the osquerybeat via Elastic-Agent but am facing some problems with the result being, it never installs. I can see it try and download a ZIP on my machine C:\\Program Files\\Elastic\\Agent\\Da… --- ## [Template already exists](https://discuss.elastic.co/t/template-already-exists/287519)
**Author:** [@dev9](https://discuss.elastic.co/u/dev9)\ **Replies:** 5\ **Last updated:** [October 25, 2021, 1:48am UTC](https://discuss.elastic.co/t/template-already-exists/287519 "2021-10-25T01:48:37Z")
Hi, how do I get rid of this template being mentioned in the log? Attempting to connect to Elasticsearch version 7.15.1 \*\*2021-10-24T16:24:25.161-0400 INFO template/load.go:111 Template "my\_template" already exists and… --- ## [Multi words synonyms with tokens between the synonym's parts](https://discuss.elastic.co/t/multi-words-synonyms-with-tokens-between-the-synonyms-parts/287518)
**Author:** [@Olaph](https://discuss.elastic.co/u/Olaph)\ **Replies:** 1\ **Last updated:** [October 24, 2021, 10:41pm UTC](https://discuss.elastic.co/t/multi-words-synonyms-with-tokens-between-the-synonyms-parts/287518 "2021-10-24T22:41:03Z")
Hi, given, that I have following synonyms configuration: "želvárium,aquaterrarium for turtles" (želvárium is czech short-term for aquarium for turtles) Is there a way that allowes me to match a document with followin… --- ## [The words in the document field are included in the query text with fuzzy logic](https://discuss.elastic.co/t/the-words-in-the-document-field-are-included-in-the-query-text-with-fuzzy-logic/287370)
**Author:** [@aleksander.zwd](https://discuss.elastic.co/u/aleksander.zwd)\ **Replies:** 0\ **Last updated:** [October 21, 2021, 9:18pm UTC](https://discuss.elastic.co/t/the-words-in-the-document-field-are-included-in-the-query-text-with-fuzzy-logic/287370 "2021-10-21T21:18:01Z")
In Elasticsearch I have an index with documents containing a text type field "name" containing first name(s) and surname, e.g .: Rebecca Donovan Julian Fred Drake Miley Angela Saunders ... and a query with a text fi… --- ## [Inputting XML from File (Windows)](https://discuss.elastic.co/t/inputting-xml-from-file-windows/287513)
**Author:** [@Tim\_Mobley](https://discuss.elastic.co/u/Tim_Mobley)\ **Replies:** 3\ **Last updated:** [October 24, 2021, 6:39pm UTC](https://discuss.elastic.co/t/inputting-xml-from-file-windows/287513 "2021-10-24T18:39:33Z")
I am attempting to use the File input plugin to ingest XML into Logstash running on a Windows host. At this point, I just want to verify that the input section of the pipeline is working. Here is the input section of my … --- ## [Filebeat can't keep up with logs volume](https://discuss.elastic.co/t/filebeat-cant-keep-up-with-logs-volume/287459)
**Author:** [@nsouth](https://discuss.elastic.co/u/nsouth)\ **Replies:** 3\ **Last updated:** [October 24, 2021, 5:45pm UTC](https://discuss.elastic.co/t/filebeat-cant-keep-up-with-logs-volume/287459 "2021-10-24T17:45:49Z")
We are trying to run Filebeat on a production server to ship logs to Logstash. However, it is failing to ship logs as quickly as they are being written. If I inspect the Filebeat's registry, it shows that over the past 3… --- ## [Metricbeat, filebeat service failed to start after logstash, kibana servers was rebooted on v7.14](https://discuss.elastic.co/t/metricbeat-filebeat-service-failed-to-start-after-logstash-kibana-servers-was-rebooted-on-v7-14/287426)
**Author:** [@cool999](https://discuss.elastic.co/u/cool999)\ **Replies:** 8\ **Last updated:** [October 24, 2021, 4:19pm UTC](https://discuss.elastic.co/t/metricbeat-filebeat-service-failed-to-start-after-logstash-kibana-servers-was-rebooted-on-v7-14/287426 "2021-10-24T16:19:13Z")
Hi Team, There was activity to reboot the servers (beats, logstash servers etc.) for patching. I noticed after this, filebeat and metricbeat services were failed (they are enabled to start on reboot). However only hear… --- ## [Tag Cloud - Split Words](https://discuss.elastic.co/t/tag-cloud-split-words/287493)
**Author:** [@mazenrb](https://discuss.elastic.co/u/mazenrb)\ **Replies:** 3\ **Last updated:** [October 24, 2021, 1:48pm UTC](https://discuss.elastic.co/t/tag-cloud-split-words/287493 "2021-10-24T13:48:31Z")
Hello all, i am trying to analyze spotify data. Therefore i would like to create a Tag Cloud for analyzing the most used words in song names. When i set up a Word/Tag Cloud and choose my field. The hole song name is co… --- ## [Can't replace character with Backslash with gsub](https://discuss.elastic.co/t/cant-replace-character-with-backslash-with-gsub/287501)
**Author:** [@Bryan\_Hamilton](https://discuss.elastic.co/u/Bryan_Hamilton)\ **Replies:** 2\ **Last updated:** [October 24, 2021, 10:35am UTC](https://discuss.elastic.co/t/cant-replace-character-with-backslash-with-gsub/287501 "2021-10-24T10:35:09Z")
Hi all. I am trying to replace the pound character in a field value with the backslash but am truggling to get it to work. The field looks like this: PoundedUNC =\> "##Network#Share#Name$" and I would like to turn it int… --- ## [Filebeat index not created](https://discuss.elastic.co/t/filebeat-index-not-created/287506)
**Author:** [@dev9](https://discuss.elastic.co/u/dev9)\ **Replies:** 13\ **Last updated:** [October 24, 2021, 5:59am UTC](https://discuss.elastic.co/t/filebeat-index-not-created/287506 "2021-10-24T05:59:44Z")
Hi Guys, I spent hours trying to get filebeat to index a custom log file but I am not having any luck in seeing any of the data ingest. I provided all of my setup details on stack overflow (formatting of yaml here is o… --- ## [After using pipeline to pipeline comunication in pipelines.yml, the other pipelines are not working](https://discuss.elastic.co/t/after-using-pipeline-to-pipeline-comunication-in-pipelines-yml-the-other-pipelines-are-not-working/287455)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 6\ **Last updated:** [October 23, 2021, 10:02pm UTC](https://discuss.elastic.co/t/after-using-pipeline-to-pipeline-comunication-in-pipelines-yml-the-other-pipelines-are-not-working/287455 "2021-10-23T22:02:56Z")
Hi, when I use pipeline to pipeline comunication in pipelines.yml the other pipelines in the file stop working. if I comment those lines the other pipelines start to work. this is my pipelines.yml, the first pipeline … --- ## [Filebeat не читает последнюю строку файла](https://discuss.elastic.co/t/filebeat/287500)
**Author:** [@IVHN](https://discuss.elastic.co/u/IVHN)\ **Replies:** 0\ **Last updated:** [October 23, 2021, 8:03pm UTC](https://discuss.elastic.co/t/filebeat/287500 "2021-10-23T20:03:39Z")
Добрый день. Столкнулся со следующей проблемой - filebeat не читает последнюю строку файла. Вот, например, есть файлик (input.log) со следующим содержимым {7,1560,2}, {7,1562,3}, {7,1564,4}, {7,1565,5}, {7,1571,6} Fi… --- ## [Kibana server is not ready yet](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/287245)
**Author:** [@spo](https://discuss.elastic.co/u/spo)\ **Replies:** 5\ **Last updated:** [October 23, 2021, 7:31pm UTC](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/287245 "2021-10-23T19:31:26Z")
Hello, I tried setting up TLS on the HTTP layer in Elasticsearch and after the process I am getting an error "Kibana server is not ready yet". root@ip-pri.ip:~# systemctl status kibana ● kibana.service - Kibana Loa… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1188) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1190)