# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1215 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1216 --- ## [Need a little help for elasticsearch query](https://discuss.elastic.co/t/need-a-little-help-for-elasticsearch-query/285794)
**Author:** [@FALEN](https://discuss.elastic.co/u/FALEN)\ **Replies:** 0\ **Last updated:** [October 4, 2021, 9:02am UTC](https://discuss.elastic.co/t/need-a-little-help-for-elasticsearch-query/285794 "2021-10-04T09:02:57Z")
Hi everyone, Need help to convert this kibana query body to elastic query api format. My goal is to create an api query, that returns all the data between spesific times. So i can reingest this data to logstash, and p… --- ## [How to minimize the reindexing time](https://discuss.elastic.co/t/how-to-minimize-the-reindexing-time/285739)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 7\ **Last updated:** [October 3, 2021, 11:31am UTC](https://discuss.elastic.co/t/how-to-minimize-the-reindexing-time/285739 "2021-10-03T11:31:42Z")
Using ELK 7.13 cluster 3 master 6 data nodes and 2 coordinate nodes Master node configuration Heap Size: 8gb Storage: 50gb(ssd) CPU: 4 Data node configuration Heap Size: 28gb Storage: 1tb(ssd) CPU: 8 Coordinate no… --- ## [Kibana: top values and "missing" (other) values](https://discuss.elastic.co/t/kibana-top-values-and-missing-other-values/285736)
**Author:** [@fabbo](https://discuss.elastic.co/u/fabbo)\ **Replies:** 1\ **Last updated:** [October 4, 2021, 8:51am UTC](https://discuss.elastic.co/t/kibana-top-values-and-missing-other-values/285736 "2021-10-04T08:51:50Z")
I'm using Kibana 7.10.2, and I want to make a pie chart where the slices are the top values of a field. There is a slider to change the number of values. However, I seem to recall that, in older versions, there was a ti… --- ## [ILM keeps losing track of indices](https://discuss.elastic.co/t/ilm-keeps-losing-track-of-indices/284055)
**Author:** [@cawoodm](https://discuss.elastic.co/u/cawoodm)\ **Replies:** 1\ **Last updated:** [October 4, 2021, 7:40am UTC](https://discuss.elastic.co/t/ilm-keeps-losing-track-of-indices/284055 "2021-10-04T07:40:11Z")
We keep seeing the issue described here where Elasticsearch is not rolling over indices properly. \[2021-09-13T12:39:16,671\]\[ERROR\]\[o.e.x.i.IndexLifecycleRunner\] \[ecom-repository01\] policy \[test-policy\] for index \[error… --- ## [Audit log rolling file retention question](https://discuss.elastic.co/t/audit-log-rolling-file-retention-question/283796)
**Author:** [@rugenl](https://discuss.elastic.co/u/rugenl)\ **Replies:** 1\ **Last updated:** [October 4, 2021, 7:30am UTC](https://discuss.elastic.co/t/audit-log-rolling-file-retention-question/283796 "2021-10-04T07:30:23Z")
Our elasticsearch \_audit.json files get rolled over daily to -audit-YYYY-MM-DD.json files and appear to be kept for 8 days. For some test nodes, I'd like to reduce the number of days these are kept for disk space usage.… --- ## [Elasticsearch Reindex is slow compare to REALLOCATION](https://discuss.elastic.co/t/elasticsearch-reindex-is-slow-compare-to-reallocation/285785)
**Author:** [@tusharnemade](https://discuss.elastic.co/u/tusharnemade)\ **Replies:** 7\ **Last updated:** [October 4, 2021, 7:19am UTC](https://discuss.elastic.co/t/elasticsearch-reindex-is-slow-compare-to-reallocation/285785 "2021-10-04T07:19:27Z")
Hello Team I am using Elasticsearch version 7.8.0. I have opened this thread for my understanding in regards to Elasticsearch internal operations. A Cluster Version : 5.6.3.0 B Cluster Version : 7.8.0.0 We are not u… --- ## [Alternative option of shingle token filter](https://discuss.elastic.co/t/alternative-option-of-shingle-token-filter/285787)
**Author:** [@ankurpatel](https://discuss.elastic.co/u/ankurpatel)\ **Replies:** 0\ **Last updated:** [October 4, 2021, 7:18am UTC](https://discuss.elastic.co/t/alternative-option-of-shingle-token-filter/285787 "2021-10-04T07:18:59Z")
I would like to implement auto suggest functionality just like google search. Shingle Token Filter is best suitable option for my requirement. Let me explain my index details. Index size is 16gb - 20 million documents.… --- ## [ILM policy for .monitoring indexes](https://discuss.elastic.co/t/ilm-policy-for-monitoring-indexes/285433)
**Author:** [@dabo](https://discuss.elastic.co/u/dabo)\ **Replies:** 2\ **Last updated:** [October 4, 2021, 6:51am UTC](https://discuss.elastic.co/t/ilm-policy-for-monitoring-indexes/285433 "2021-10-04T06:51:13Z")
Hi, How do I properly set up an ILM policy for .monitoring-\* indexes? When I create a policy and add it to the index templates I get some error about rollover\_alias Then when I add rollover alias and I get another err… --- ## [Elasticsearch Index Split](https://discuss.elastic.co/t/elasticsearch-index-split/285649)
**Author:** [@tusharnemade](https://discuss.elastic.co/u/tusharnemade)\ **Replies:** 4\ **Last updated:** [October 4, 2021, 6:33am UTC](https://discuss.elastic.co/t/elasticsearch-index-split/285649 "2021-10-04T06:33:28Z")
Hello Team I am using Elasticsearch version 7.8.0 I used API "SPLIT" to break my big index into multiple shards. After split was concluded successfully.... I found that my new SPLITTED Index \[ myindex-000797-sp \] is … --- ## [Elasticsearch curator restoring ".security" index during restore action](https://discuss.elastic.co/t/elasticsearch-curator-restoring-security-index-during-restore-action/285648)
**Author:** [@163satish](https://discuss.elastic.co/u/163satish)\ **Replies:** 8\ **Last updated:** [October 4, 2021, 5:45am UTC](https://discuss.elastic.co/t/elasticsearch-curator-restoring-security-index-during-restore-action/285648 "2021-10-04T05:45:41Z")
I am using Elasticsearch curator 5.8 to take snapshot on region1 and restore on region2. Recently, cluster was upgraded to 7.14, and I needed to upgrade curator to 5.8 (min 5.7 is needed). Now, when I am restoring a sna… --- ## [Why Elasticsearch delete repository API only removes reference](https://discuss.elastic.co/t/why-elasticsearch-delete-repository-api-only-removes-reference/285660)
**Author:** [@Deepika\_Dhiman](https://discuss.elastic.co/u/Deepika_Dhiman)\ **Replies:** 6\ **Last updated:** [October 4, 2021, 4:43am UTC](https://discuss.elastic.co/t/why-elasticsearch-delete-repository-api-only-removes-reference/285660 "2021-10-04T04:43:05Z")
I am using Elasticsearch API to delete the Elasticsearch repository and Elasticsearch locations. But in both cases, Physical folders remain intact in the file system. I read in the documentation that delete API only rem… --- ## [Translog is corrupted](https://discuss.elastic.co/t/translog-is-corrupted/285208)
**Author:** [@fetch](https://discuss.elastic.co/u/fetch)\ **Replies:** 2\ **Last updated:** [October 4, 2021, 4:24am UTC](https://discuss.elastic.co/t/translog-is-corrupted/285208 "2021-10-04T04:24:02Z")
Hello, I have a cluster of 3 ES nodes that uses 7.10.1 version. One node had an HDD failure last night. We have bring it up and almost all indices have recovered successfully. However, there are 4 indices that fails to… --- ## [How to use variable inside a switch condition?](https://discuss.elastic.co/t/how-to-use-variable-inside-a-switch-condition/285188)
**Author:** [@isaacli](https://discuss.elastic.co/u/isaacli)\ **Replies:** 2\ **Last updated:** [October 4, 2021, 1:10am UTC](https://discuss.elastic.co/t/how-to-use-variable-inside-a-switch-condition/285188 "2021-10-04T01:10:50Z")
Hello, I am trying to build a traffic light element inside Canvas. I am using different variables to control the expression. However, I found that the variables are not working inside the "Switch" condition blocks. fi… --- ## [Elasticsearch stopped with Cassandra](https://discuss.elastic.co/t/elasticsearch-stopped-with-cassandra/285284)
**Author:** [@Klaus\_Salazar](https://discuss.elastic.co/u/Klaus_Salazar)\ **Replies:** 3\ **Last updated:** [October 3, 2021, 11:56pm UTC](https://discuss.elastic.co/t/elasticsearch-stopped-with-cassandra/285284 "2021-10-03T23:56:41Z")
Hi, i have a big problem with Elasticsearch and this is that when i install Cassandra database automaticly Elastic is stopped, then i see that Cassandra is running but Elastic not and later if i stop cassandra my Elastic… --- ## [Filebeat Indexes, Aliases and Errors](https://discuss.elastic.co/t/filebeat-indexes-aliases-and-errors/285769)
**Author:** [@mhare](https://discuss.elastic.co/u/mhare)\ **Replies:** 1\ **Last updated:** [October 3, 2021, 10:05pm UTC](https://discuss.elastic.co/t/filebeat-indexes-aliases-and-errors/285769 "2021-10-03T22:05:26Z")
I am running ElasticStack 7.13.4 with Filebeat on Windows 10 I am ingesting several types of logs with Filebeat and wanted to put each of them into their own Index. In filebeat I created an input as #-----------------… --- ## [Insert records for parent/child in same index of elastic search](https://discuss.elastic.co/t/insert-records-for-parent-child-in-same-index-of-elastic-search/285774)
**Author:** [@manjurgani](https://discuss.elastic.co/u/manjurgani)\ **Replies:** 0\ **Last updated:** [October 3, 2021, 6:52pm UTC](https://discuss.elastic.co/t/insert-records-for-parent-child-in-same-index-of-elastic-search/285774 "2021-10-03T18:52:49Z")
I have created a mapping in Elasticsearch like below POST /INDEX { "mappings": { "properties": { "id": { "type": "keyword" }, "join\_field": { "typ… --- ## [Filebeat Connection to Elastic Search Error](https://discuss.elastic.co/t/filebeat-connection-to-elastic-search-error/285733)
**Author:** [@siddhesh\_jadhav](https://discuss.elastic.co/u/siddhesh_jadhav)\ **Replies:** 13\ **Last updated:** [October 3, 2021, 5:09pm UTC](https://discuss.elastic.co/t/filebeat-connection-to-elastic-search-error/285733 "2021-10-03T17:09:56Z")
HI, I tried installing filebeat on win10. used ' .\\filebeat.exe -e test config' the output says Config OK. but while testing output of filebeat using '.\\filebeat.exe -e test output' it dsiplays the following error. ple… --- ## [Data not showing in elastic and kibana for one of the index pattern out of three indexes](https://discuss.elastic.co/t/data-not-showing-in-elastic-and-kibana-for-one-of-the-index-pattern-out-of-three-indexes/284464)
**Author:** [@vasanthyvns](https://discuss.elastic.co/u/vasanthyvns)\ **Replies:** 3\ **Last updated:** [October 3, 2021, 3:45pm UTC](https://discuss.elastic.co/t/data-not-showing-in-elastic-and-kibana-for-one-of-the-index-pattern-out-of-three-indexes/284464 "2021-10-03T15:45:01Z")
I have enabled logstash to monitor 3 different logs, but somehow data is not showing up for one of the index pattern, checked almost everything and couldn't find anything. Not sure if i am missing something here. --- ## [Create Alert by Comparing 2 fields in 2 indexes](https://discuss.elastic.co/t/create-alert-by-comparing-2-fields-in-2-indexes/284694)
**Author:** [@Abanob\_Medhat](https://discuss.elastic.co/u/Abanob_Medhat)\ **Replies:** 2\ **Last updated:** [October 3, 2021, 10:23am UTC](https://discuss.elastic.co/t/create-alert-by-comparing-2-fields-in-2-indexes/284694 "2021-10-03T10:23:19Z")
Hi, I want to compare 2 fields from 2 different indexes to create alert. the 2 indexes , one for apache access logs and the other one is my IOCs. All what I want to do is to compare between the vulnerable IPs in my IO… --- ## [Building metricbeat from source on Mac with no X-Code](https://discuss.elastic.co/t/building-metricbeat-from-source-on-mac-with-no-x-code/285532)
**Author:** [@ss\_22](https://discuss.elastic.co/u/ss_22)\ **Replies:** 3\ **Last updated:** [October 2, 2021, 9:31pm UTC](https://discuss.elastic.co/t/building-metricbeat-from-source-on-mac-with-no-x-code/285532 "2021-10-02T21:31:24Z")
Hello, I am trying to build the current master branch metricbeat image from source code on my mac (macOS Catalina V10.15.7). I have been following the developer guides. Everything installed and it goes great when I run… --- ## [Search template - how to pass array of values as parameter](https://discuss.elastic.co/t/search-template-how-to-pass-array-of-values-as-parameter/285756)
**Author:** [@askids](https://discuss.elastic.co/u/askids)\ **Replies:** 0\ **Last updated:** [October 2, 2021, 8:16pm UTC](https://discuss.elastic.co/t/search-template-how-to-pass-array-of-values-as-parameter/285756 "2021-10-02T20:16:03Z")
hi, I am trying to convert an existing query using term\_set to a search template. But I am unable to find any documentation that shows how to pass array value as parameter input. There is sample for passing json array t… --- ## [Unknown\_host\_exception | watcher webhook](https://discuss.elastic.co/t/unknown-host-exception-watcher-webhook/285753)
**Author:** [@Juliana\_Sabino](https://discuss.elastic.co/u/Juliana_Sabino)\ **Replies:** 5\ **Last updated:** [October 2, 2021, 7:45pm UTC](https://discuss.elastic.co/t/unknown-host-exception-watcher-webhook/285753 "2021-10-02T19:45:03Z")
Hi Team, I'm a newbie and I'm trying to create a watcher. I'm receiving this error and I don't know what I'm doing wrong. "actions": \[ { "id": "my\_webhook", "type": "webhook", "status": "… --- ## [Displaying data from one event to other events](https://discuss.elastic.co/t/displaying-data-from-one-event-to-other-events/285747)
**Author:** [@mostafaelsayed](https://discuss.elastic.co/u/mostafaelsayed)\ **Replies:** 10\ **Last updated:** [October 2, 2021, 7:42pm UTC](https://discuss.elastic.co/t/displaying-data-from-one-event-to-other-events/285747 "2021-10-02T19:42:19Z")
Hello All Is there a way in kibana to display fields from one event to other related events in data tables aggregations and discover views? for example, 2 events with this format: 1. { id: 1, city: 'London', tem… --- ## [How to get license key to use ML feature?](https://discuss.elastic.co/t/how-to-get-license-key-to-use-ml-feature/285749)
**Author:** [@quyennguyen](https://discuss.elastic.co/u/quyennguyen)\ **Replies:** 2\ **Last updated:** [October 2, 2021, 6:59pm UTC](https://discuss.elastic.co/t/how-to-get-license-key-to-use-ml-feature/285749 "2021-10-02T18:59:47Z")
I install Elasticsearch, Kibana and Logstash in Ubuntu 18.04. I already used a 30-day free trial and everything went well. Now I need the license key to continue using the ML feature in the future. But don't know to get… --- ## [Low writing speed on SSD, identify bottleneck](https://discuss.elastic.co/t/low-writing-speed-on-ssd-identify-bottleneck/285726)
**Author:** [@sdwerwed](https://discuss.elastic.co/u/sdwerwed)\ **Replies:** 5\ **Last updated:** [October 2, 2021, 3:35pm UTC](https://discuss.elastic.co/t/low-writing-speed-on-ssd-identify-bottleneck/285726 "2021-10-02T15:35:19Z")
Hello Elasticseach community! :slight\_smile: Writing speed on SSD is low and I am not sure where the bottleneck is. I use Elasticsearch 7.14.0 in Kubernetes 4 data nodes 3 masters 8G RAM 4g heap 1 CPU each 512 Standa… --- ## [How to make an logstash pipeline to run contuously (Elasticsearch input plugin)](https://discuss.elastic.co/t/how-to-make-an-logstash-pipeline-to-run-contuously-elasticsearch-input-plugin/285714)
**Author:** [@Thanura\_Kannangara](https://discuss.elastic.co/u/Thanura_Kannangara)\ **Replies:** 3\ **Last updated:** [October 2, 2021, 3:22pm UTC](https://discuss.elastic.co/t/how-to-make-an-logstash-pipeline-to-run-contuously-elasticsearch-input-plugin/285714 "2021-10-02T15:22:33Z")
Hey Folks, I'm running an elastic pipeline to read from Elasticsearch and write documents to an S3 bucket input { elasticsearch { ssl =\> true hosts =\> \["\"\] user =\> "\" password =\> "\<… --- ## [ERROR#011\[logstash\]#011logstash/async.go:280#011Failed to publish events caused by: write tcp 172.31.82.54:52674-\>172.31.22.210:5044: write: connection reset by peer](https://discuss.elastic.co/t/error-011-logstash-011logstash-async-go-280-011failed-to-publish-events-caused-by-write-tcp-172-31-82-54-52674-172-31-22-210-write-connection-reset-by-peer/285729)
**Author:** [@sai\_dheeraj](https://discuss.elastic.co/u/sai_dheeraj)\ **Replies:** 1\ **Last updated:** [October 2, 2021, 1:41pm UTC](https://discuss.elastic.co/t/error-011-logstash-011logstash-async-go-280-011failed-to-publish-events-caused-by-write-tcp-172-31-82-54-52674-172-31-22-210-write-connection-reset-by-peer/285729 "2021-10-02T13:41:28Z")
Oct 2 08:16:56 ip-172-31-82-54 filebeat: 2021-10-02T08:16:56.116Z#011INFO#011\[publisher\]#011pipeline/retry.go:219#011retryer: send unwait signal to consumer Oct 2 08:16:56 ip-172-31-82-54 filebeat: 2021-10-02T08:16:56… --- ## [Curl -XGET 'http://127.0.0.1:9200'](https://discuss.elastic.co/t/curl-xget-http-127-0-0-1-9200/285645)
**Author:** [@sandy12](https://discuss.elastic.co/u/sandy12)\ **Replies:** 3\ **Last updated:** [October 2, 2021, 12:27pm UTC](https://discuss.elastic.co/t/curl-xget-http-127-0-0-1-9200/285645 "2021-10-02T12:27:40Z")
When I am running this command curl -XGET 'http://127.0.0.1:9200' getting below error Request on loopback from external IP Request on loopback from external IP Description: Your request is prohibited because the reque… --- ## [How to accept rsyslog on logstash with filebeat](https://discuss.elastic.co/t/how-to-accept-rsyslog-on-logstash-with-filebeat/285734)
**Author:** [@sandy12](https://discuss.elastic.co/u/sandy12)\ **Replies:** 0\ **Last updated:** [October 2, 2021, 12:10pm UTC](https://discuss.elastic.co/t/how-to-accept-rsyslog-on-logstash-with-filebeat/285734 "2021-10-02T12:10:00Z")
I want to send logs from rsyslog server to logstash and then to Elasticsearch. But I want to send rsyslog with installing filebeat . Can you please tell me how to accept the rsyslog on logstash server. What settings I… --- ## [Join python prediction with kibana visualisations](https://discuss.elastic.co/t/join-python-prediction-with-kibana-visualisations/285619)
**Author:** [@oussy\_hdm](https://discuss.elastic.co/u/oussy_hdm)\ **Replies:** 2\ **Last updated:** [October 2, 2021, 8:08am UTC](https://discuss.elastic.co/t/join-python-prediction-with-kibana-visualisations/285619 "2021-10-02T08:08:24Z")
Hi, I'm new to ELK, and I have two Visualizations for two models predictions in python and i want to join them to an existing Dashboard in kibana. Is this possible? I tried to index every prediction algorithme value… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1214) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1216)