# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1206 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1207 --- ## [Elastic search 6.8.1 - missing indices](https://discuss.elastic.co/t/elastic-search-6-8-1-missing-indices/286364)
**Author:** [@Dan7](https://discuss.elastic.co/u/Dan7)\ **Replies:** 1\ **Last updated:** [October 12, 2021, 12:22am UTC](https://discuss.elastic.co/t/elastic-search-6-8-1-missing-indices/286364 "2021-10-12T00:22:58Z")
Good day, I have an Elasticsearch 6.8.1 single node cluster running inside a kubernetes statefulset to index documents that I need to look after and I noticed that the snapshot path.repo had not been setup previously. S… --- ## [\[.kibana\_task\_manager\] Action failed with 'Request timed out'](https://discuss.elastic.co/t/kibana-task-manager-action-failed-with-request-timed-out/286389)
**Author:** [@DenisSermyagin](https://discuss.elastic.co/u/DenisSermyagin)\ **Replies:** 3\ **Last updated:** [October 11, 2021, 8:17pm UTC](https://discuss.elastic.co/t/kibana-task-manager-action-failed-with-request-timed-out/286389 "2021-10-11T20:17:49Z")
Hello! I have deployed Elasticsearch and kibana versions 7.13.4. I encountered this error: {"type":"log","@timestamp":"2021-10-11T15:41:58+00:00","tags":\["info","savedobjects-service"\],"pid":948,"message":"\[.kibana\_ta… --- ## [Json v/s ndjson in Kibana](https://discuss.elastic.co/t/json-v-s-ndjson-in-kibana/285879)
**Author:** [@Rakhi](https://discuss.elastic.co/u/Rakhi)\ **Replies:** 1\ **Last updated:** [October 11, 2021, 8:11pm UTC](https://discuss.elastic.co/t/json-v-s-ndjson-in-kibana/285879 "2021-10-11T20:11:05Z")
In our case the ndjson files are checked into git repository and deployed from there into Kibana. But whenever we make changes to the Kibana dashboards -\> we export the ndjson -\> and manually handpick and then merge the… --- ## [Cumulative running total for field independant of search range](https://discuss.elastic.co/t/cumulative-running-total-for-field-independant-of-search-range/286406)
**Author:** [@d\_s\_9](https://discuss.elastic.co/u/d_s_9)\ **Replies:** 0\ **Last updated:** [October 11, 2021, 7:23pm UTC](https://discuss.elastic.co/t/cumulative-running-total-for-field-independant-of-search-range/286406 "2021-10-11T19:23:55Z")
Hi all, I'm indexing time series documents containing a timestamp as well as an integer value which i want to have a running total for, starting from the first indexed document and adding all of the supplied values of t… --- ## [Error for logstash.conf](https://discuss.elastic.co/t/error-for-logstash-conf/286400)
**Author:** [@Johnny\_Cash\_Cow](https://discuss.elastic.co/u/Johnny_Cash_Cow)\ **Replies:** 0\ **Last updated:** [October 11, 2021, 6:44pm UTC](https://discuss.elastic.co/t/error-for-logstash-conf/286400 "2021-10-11T18:44:47Z")
The only non-commented out line of my logstash.conf is: path.config: "C:/ELK/logstash-7.15.0-windows-x86\_64/logstash-7.15.0/config/logstash-sample.conf" My only non commented out section is of my pipeline.yml: - pip… --- ## [Yet, another Firewall question](https://discuss.elastic.co/t/yet-another-firewall-question/286078)
**Author:** [@mhare](https://discuss.elastic.co/u/mhare)\ **Replies:** 3\ **Last updated:** [October 11, 2021, 6:13pm UTC](https://discuss.elastic.co/t/yet-another-firewall-question/286078 "2021-10-11T18:13:13Z")
I am running Stack 7.13.4 on Windows 10 with McAfee Small Business Security (a Firewall among other things) I have two nodes of Elasticsearch and One of Kibana on this one machine. I have opened TCP/UDP ports 9200, 92… --- ## [Filebeat multi line stopped working](https://discuss.elastic.co/t/filebeat-multi-line-stopped-working/286397)
**Author:** [@Indigo\_Star](https://discuss.elastic.co/u/Indigo_Star)\ **Replies:** 2\ **Last updated:** [October 11, 2021, 5:55pm UTC](https://discuss.elastic.co/t/filebeat-multi-line-stopped-working/286397 "2021-10-11T17:55:50Z")
Hi, I have been using the filebeat for sometime with multiline pattern. Everything was working fine last week it stopped working. I was using 7.14.1 for filebeat but now i've tried 7.6.2 and 7.15 both. I've been trying… --- ## [Indexing Multipolyon with Elasticearch](https://discuss.elastic.co/t/indexing-multipolyon-with-elasticearch/286265)
**Author:** [@Faradandy](https://discuss.elastic.co/u/Faradandy)\ **Replies:** 5\ **Last updated:** [October 11, 2021, 5:50pm UTC](https://discuss.elastic.co/t/indexing-multipolyon-with-elasticearch/286265 "2021-10-11T17:50:56Z")
Hi there, I'm using Elasticsearch 7.15 with GDAL 3.3.1 and trying to index the UK Land Registry Dataset. I currently have these data stored in a PSQL table and am trying to use ogr2ogr to create the ES index. I've def… --- ## [Refresh\_interval less than 1 per second?](https://discuss.elastic.co/t/refresh-interval-less-than-1-per-second/286069)
**Author:** [@Vadym](https://discuss.elastic.co/u/Vadym)\ **Replies:** 7\ **Last updated:** [October 11, 2021, 5:46pm UTC](https://discuss.elastic.co/t/refresh-interval-less-than-1-per-second/286069 "2021-10-11T17:46:17Z")
Hi guys, We are syncing data from Couchbase into Elasticsearch via CBES connector and have up to ~550ms delay from CBES inserting data into ES. Afterwards it takes up to 2 seconds for data to become searchable in ES. D… --- ## [Yellow Cluster Health - Missing Replica Shards](https://discuss.elastic.co/t/yellow-cluster-health-missing-replica-shards/285859)
**Author:** [@David\_Reck](https://discuss.elastic.co/u/David_Reck)\ **Replies:** 3\ **Last updated:** [October 11, 2021, 5:43pm UTC](https://discuss.elastic.co/t/yellow-cluster-health-missing-replica-shards/285859 "2021-10-11T17:43:07Z")
Hello everyone, I am continually having new indexes get created with a yellow status. When I do a \_cluster/allocation/explain I get this back { "index" : "vnext-signalrhub-2021.10.05", "shard" : 0, "primary" : f… --- ## [Elasticsearch Data Recovery](https://discuss.elastic.co/t/elasticsearch-data-recovery/286009)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 3\ **Last updated:** [October 11, 2021, 5:33pm UTC](https://discuss.elastic.co/t/elasticsearch-data-recovery/286009 "2021-10-11T17:33:28Z")
Hi, We had an incident where all master nodes failed. After they were auto-replaced the old data nodes did not reconnect to the master due to state mismatch. While we were able to clear down the state so the nodes could… --- ## [Logstash- Create different logfiles for different pipeline](https://discuss.elastic.co/t/logstash-create-different-logfiles-for-different-pipeline/286370)
**Author:** [@praffuln](https://discuss.elastic.co/u/praffuln)\ **Replies:** 1\ **Last updated:** [October 11, 2021, 5:14pm UTC](https://discuss.elastic.co/t/logstash-create-different-logfiles-for-different-pipeline/286370 "2021-10-11T17:14:52Z")
Hi, I am using logstash log4j2.properties configuration for log controlling e.g. log rotation, log preservation, controlling file name for logging, location of logs etc. Based on below discussion I used to configure lo… --- ## [DNS filter, how to save IP to a separate field](https://discuss.elastic.co/t/dns-filter-how-to-save-ip-to-a-separate-field/286391)
**Author:** [@mohsin106](https://discuss.elastic.co/u/mohsin106)\ **Replies:** 1\ **Last updated:** [October 11, 2021, 5:06pm UTC](https://discuss.elastic.co/t/dns-filter-how-to-save-ip-to-a-separate-field/286391 "2021-10-11T17:06:28Z")
Hi, I'm using the DNS filter in my Logstash conf and I would like to store the IP address that the filter is resolving to a separate field. I tried using the add\_field parameter but its not working. I end up storing the… --- ## [Timestamp ISSUE](https://discuss.elastic.co/t/timestamp-issue/286170)
**Author:** [@frank\_rib](https://discuss.elastic.co/u/frank_rib)\ **Replies:** 3\ **Last updated:** [October 11, 2021, 4:54pm UTC](https://discuss.elastic.co/t/timestamp-issue/286170 "2021-10-11T16:54:01Z")
Hello every body, I have a stand allone architecture. Logs are sent from syslog\_ng server to logstash - \> Elasticsearch -\> kibana. I have a probleme with the timestamp as the capture below shows The logs are received … --- ## [Terms query routing optimization](https://discuss.elastic.co/t/terms-query-routing-optimization/286390)
**Author:** [@Ragav\_Kb](https://discuss.elastic.co/u/Ragav_Kb)\ **Replies:** 0\ **Last updated:** [October 11, 2021, 4:21pm UTC](https://discuss.elastic.co/t/terms-query-routing-optimization/286390 "2021-10-11T16:21:39Z")
My search is going to look something as below. For most cases the number of items in userId is expected to be between 100 to 200 atmost, although on some cases it may go up to 1000. Is there anything to consider in gene… --- ## [Change or disable the elastic-agent grpc.port during fleet server setup in docker container](https://discuss.elastic.co/t/change-or-disable-the-elastic-agent-grpc-port-during-fleet-server-setup-in-docker-container/286388)
**Author:** [@Yustas](https://discuss.elastic.co/u/Yustas)\ **Replies:** 0\ **Last updated:** [October 11, 2021, 3:42pm UTC](https://discuss.elastic.co/t/change-or-disable-the-elastic-agent-grpc-port-during-fleet-server-setup-in-docker-container/286388 "2021-10-11T15:42:08Z")
Hello. I want run two fleet-agent 7.15 on same host. Becouse one must run in fleet-server mode and other with different policy for retrive syslog events from remoute source. I use docker-compose to cnfigure agents and… --- ## [Search\_phase\_execution\_exception](https://discuss.elastic.co/t/search-phase-execution-exception/286336)
**Author:** [@prashanth\_sri](https://discuss.elastic.co/u/prashanth_sri)\ **Replies:** 2\ **Last updated:** [October 11, 2021, 3:27pm UTC](https://discuss.elastic.co/t/search-phase-execution-exception/286336 "2021-10-11T15:27:07Z")
hi all , i have 15 nodes in my Elasticsearch cluster, and each shards have 10GB , currently we have (1 shard+2 replicas ) ,we are using 6.18 elastic version , we are try ing to access data from api , but when i am runni… --- ## [Metadata \_tier value after rollover](https://discuss.elastic.co/t/metadata-tier-value-after-rollover/286117)
**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Replies:** 1\ **Last updated:** [October 11, 2021, 3:13pm UTC](https://discuss.elastic.co/t/metadata-tier-value-after-rollover/286117 "2021-10-11T15:13:23Z")
Hey there, Is there a way to change the Metadata \_tier value after that an ILM is executed? If an index starts with \_tier set to data\_hot and then it is moved to a warm node, can I change the Metadata automatically? I… --- ## [How to read local0 files in unix using filebeat](https://discuss.elastic.co/t/how-to-read-local0-files-in-unix-using-filebeat/286181)
**Author:** [@muralikrishna](https://discuss.elastic.co/u/muralikrishna)\ **Replies:** 1\ **Last updated:** [October 11, 2021, 3:02pm UTC](https://discuss.elastic.co/t/how-to-read-local0-files-in-unix-using-filebeat/286181 "2021-10-11T15:02:28Z")
Hello Everyone, I have some applications writing the logs to local0.info & local4.info file in UNIX servers. I have to read the log content from above files using filebeat.yml and send the same to Logstash. We can't r… --- ## [How to move nested key value to root level and then rename elements root name?](https://discuss.elastic.co/t/how-to-move-nested-key-value-to-root-level-and-then-rename-elements-root-name/286059)
**Author:** [@mguttula](https://discuss.elastic.co/u/mguttula)\ **Replies:** 4\ **Last updated:** [October 11, 2021, 3:01pm UTC](https://discuss.elastic.co/t/how-to-move-nested-key-value-to-root-level-and-then-rename-elements-root-name/286059 "2021-10-11T15:01:26Z")
How to move nested key value to root level and then rename elements root name I have 4 core cpu and below is a sample of details for 2 cpu core from the source. { "\_source": { "cpu\_usage": { "sys/host-info/… --- ## [How to read the log file in a path using regular expression in filebeat](https://discuss.elastic.co/t/how-to-read-the-log-file-in-a-path-using-regular-expression-in-filebeat/286377)
**Author:** [@muralikrishna](https://discuss.elastic.co/u/muralikrishna)\ **Replies:** 0\ **Last updated:** [October 11, 2021, 2:58pm UTC](https://discuss.elastic.co/t/how-to-read-the-log-file-in-a-path-using-regular-expression-in-filebeat/286377 "2021-10-11T14:58:55Z")
Hello Everyone, I have stuck with an issue to collect/read the logs from a path using regular expression using filebeat. Could some one help me with my issue. Context: I have some servers where the logs are being writt… --- ## [Support SLM (Snapshot Lifecycle management) for license 7.10.2 Elashticsearch](https://discuss.elastic.co/t/support-slm-snapshot-lifecycle-management-for-license-7-10-2-elashticsearch/286354)
**Author:** [@ttttien](https://discuss.elastic.co/u/ttttien)\ **Replies:** 6\ **Last updated:** [October 11, 2021, 2:58pm UTC](https://discuss.elastic.co/t/support-slm-snapshot-lifecycle-management-for-license-7-10-2-elashticsearch/286354 "2021-10-11T14:58:27Z")
Hello everyone, I would like to know that Elasticsearch version 7.10.2 supports or not for SLM (Snapshot Lifecycle Management) in open versions (not enterprise) ? And how can I get the link of the information about that… --- ## [Connect Remote Cluster with Security](https://discuss.elastic.co/t/connect-remote-cluster-with-security/285941)
**Author:** [@rachelyang](https://discuss.elastic.co/u/rachelyang)\ **Replies:** 4\ **Last updated:** [October 11, 2021, 2:26pm UTC](https://discuss.elastic.co/t/connect-remote-cluster-with-security/285941 "2021-10-11T14:26:14Z")
My local cluster has already set up transport and ssl security. Now I am going to connect a remote cluster which has its own ca.crt file. How can I make the local and remote clusters to trust each other? Here is the err… --- ## [Label leader lines on pie charts](https://discuss.elastic.co/t/label-leader-lines-on-pie-charts/286365)
**Author:** [@Mathias\_Christian\_Cl](https://discuss.elastic.co/u/Mathias_Christian_Cl)\ **Replies:** 6\ **Last updated:** [October 11, 2021, 2:24pm UTC](https://discuss.elastic.co/t/label-leader-lines-on-pie-charts/286365 "2021-10-11T14:24:35Z")
Hi, I am using Elastic 7.14 and I am trying to create a pie chart which also shows lines from the pie chart to the percentage values. If one slice of the pie is large enough, it is okay to display the value, but if not … --- ## [How to install elastic/kibana/logstash in custom path?](https://discuss.elastic.co/t/how-to-install-elastic-kibana-logstash-in-custom-path/286366)
**Author:** [@Mamol27](https://discuss.elastic.co/u/Mamol27)\ **Replies:** 4\ **Last updated:** [October 11, 2021, 12:52pm UTC](https://discuss.elastic.co/t/how-to-install-elastic-kibana-logstash-in-custom-path/286366 "2021-10-11T12:52:41Z")
I need to install Elasticsearch in /opt/elasticsearch, kibana and logstash like this. And then autostart via systemctl. So, I tried like this Install Elasticsearch with RPM | Elasticsearch Reference \[6.2\] | Elastic I e… --- ## [7.15.0 kibana rpm hash mismatch](https://discuss.elastic.co/t/7-15-0-kibana-rpm-hash-mismatch/286237)
**Author:** [@mtaormina](https://discuss.elastic.co/u/mtaormina)\ **Replies:** 1\ **Last updated:** [October 11, 2021, 2:12pm UTC](https://discuss.elastic.co/t/7-15-0-kibana-rpm-hash-mismatch/286237 "2021-10-11T14:12:32Z")
I'm getting a hash mismatch on the 64-bit RPM download for kibana 7.15.0 at https://artifacts.elastic.co/downloads/kibana/kibana-7.15.0-x86\_64.rpm. The SHA512 file says: 1de33aa9a653837d41afe52517e66ae5cc68866020e797939e… --- ## [Kibana visualizations - Apply operations on value returned by a metric](https://discuss.elastic.co/t/kibana-visualizations-apply-operations-on-value-returned-by-a-metric/286356)
**Author:** [@aza-zil](https://discuss.elastic.co/u/aza-zil)\ **Replies:** 1\ **Last updated:** [October 11, 2021, 1:48pm UTC](https://discuss.elastic.co/t/kibana-visualizations-apply-operations-on-value-returned-by-a-metric/286356 "2021-10-11T13:48:41Z")
I have a visualization where I have a metric field that contains the sum of durations (in millisecond), I want to show it in (hh:mm:ss) form, is that possible? --- ## [Details/Insights on how switching the index behind an alias works](https://discuss.elastic.co/t/details-insights-on-how-switching-the-index-behind-an-alias-works/286146)
**Author:** [@Nexonus](https://discuss.elastic.co/u/Nexonus)\ **Replies:** 4\ **Last updated:** [October 11, 2021, 12:42pm UTC](https://discuss.elastic.co/t/details-insights-on-how-switching-the-index-behind-an-alias-works/286146 "2021-10-11T12:42:44Z")
I would like to get some insight information about how an alias switch works. Our scenario We observed a scenario in our cluster (only 3 nodes) where we did an alias switch and still queried the old data from the old in… --- ## [ELK stack basic license query for use](https://discuss.elastic.co/t/elk-stack-basic-license-query-for-use/286342)
**Author:** [@jaykansagara](https://discuss.elastic.co/u/jaykansagara)\ **Replies:** 3\ **Last updated:** [October 11, 2021, 11:56am UTC](https://discuss.elastic.co/t/elk-stack-basic-license-query-for-use/286342 "2021-10-11T11:56:41Z")
Hi, Currently we are using ELK stack oss version. We are not take any charges from our client like for number of users. We just take charges of our service only. Now I want to know that, If I give basic version of ELK … --- ## [How to test the result of a query and take an action based on that result?](https://discuss.elastic.co/t/how-to-test-the-result-of-a-query-and-take-an-action-based-on-that-result/286362)
**Author:** [@mfilipelopes](https://discuss.elastic.co/u/mfilipelopes)\ **Replies:** 0\ **Last updated:** [October 11, 2021, 11:47am UTC](https://discuss.elastic.co/t/how-to-test-the-result-of-a-query-and-take-an-action-based-on-that-result/286362 "2021-10-11T11:47:58Z")
Hi. Is there a way to test the result of a query and take an action based on that result? I need to do the following: For new coming documents, make a search on a index X to see if that document already exists and if … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1205) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1207)