# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1275 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1276 --- ## [How to listen for index change events](https://discuss.elastic.co/t/how-to-listen-for-index-change-events/281893)
**Author:** [@zhyp](https://discuss.elastic.co/u/zhyp)\ **Replies:** 1\ **Last updated:** [August 19, 2021, 2:47am UTC](https://discuss.elastic.co/t/how-to-listen-for-index-change-events/281893 "2021-08-19T02:47:59Z")
Hi My demand is real-time statistics. Can I listen for changes in an index? For example, if the value of a field changes, I can monitor it and make statistics again. :slightly\_smiling\_face: --- ## [Can a winlogbeats agent be used as a relay?](https://discuss.elastic.co/t/can-a-winlogbeats-agent-be-used-as-a-relay/281892)
**Author:** [@jeromeat](https://discuss.elastic.co/u/jeromeat)\ **Replies:** 1\ **Last updated:** [August 19, 2021, 12:53am UTC](https://discuss.elastic.co/t/can-a-winlogbeats-agent-be-used-as-a-relay/281892 "2021-08-19T00:53:46Z")
Is it possible for one Windows server running Winlogbeats to forward its windows event logs to another Windows server running Winlogbeats that can then forward/relay them to elastic? I'd prefer not to go through the com… --- ## [Custom Date-Time-Zone format in Kibana visualize](https://discuss.elastic.co/t/custom-date-time-zone-format-in-kibana-visualize/280571)
**Author:** [@sohenrane](https://discuss.elastic.co/u/sohenrane)\ **Replies:** 3\ **Last updated:** [August 19, 2021, 12:08am UTC](https://discuss.elastic.co/t/custom-date-time-zone-format-in-kibana-visualize/280571 "2021-08-19T00:08:22Z")
In Kibana visualize, want to see Epoch being converted to Date-Time with Zone in any format. Currently, using "moment.js" format in "Index Patterns" -\> "epoch" -\> "Format" (Date Nanos): ddd Do-MMM-YYYY Qo DDDo wo HH:mm… --- ## [HTTP Input/Output](https://discuss.elastic.co/t/http-input-output/281593)
**Author:** [@tofubeats](https://discuss.elastic.co/u/tofubeats)\ **Replies:** 6\ **Last updated:** [August 18, 2021, 10:20pm UTC](https://discuss.elastic.co/t/http-input-output/281593 "2021-08-18T22:20:26Z")
Hello, I am working on connecting two instances of logstash by an HTTP plugin. On node 1, the config is set to ingest from a CSV and outputs those docs to a local HTTP url. As in, the URL is set to a port on node 1. O… --- ## [Hide specific visualization from by +- button in the legend](https://discuss.elastic.co/t/hide-specific-visualization-from-by-button-in-the-legend/280848)
**Author:** [@Etay\_Todress](https://discuss.elastic.co/u/Etay_Todress)\ **Replies:** 2\ **Last updated:** [August 18, 2021, 10:04pm UTC](https://discuss.elastic.co/t/hide-specific-visualization-from-by-button-in-the-legend/280848 "2021-08-18T22:04:06Z")
Hi, I'm trying to hide one of the charts, by clicking the legend and then - , but the current version doesn’t allow me to do that. I wish there was a checkbox that could control which chart to hide/view, is there any o… --- ## [Corrupt index due to missing file](https://discuss.elastic.co/t/corrupt-index-due-to-missing-file/281867)
**Author:** [@RonJenningsFTI](https://discuss.elastic.co/u/RonJenningsFTI)\ **Replies:** 3\ **Last updated:** [August 18, 2021, 9:46pm UTC](https://discuss.elastic.co/t/corrupt-index-due-to-missing-file/281867 "2021-08-18T21:46:54Z")
Greetings, people who know way more about ElasticSearch than I do! I'm very new to Elastic administration, as our organization has only recently started using it, so please pardon my lack of knowledge. We have a 4-node … --- ## [Reduce Bulk rejections](https://discuss.elastic.co/t/reduce-bulk-rejections/281782)
**Author:** [@Praveen\_Atluri](https://discuss.elastic.co/u/Praveen_Atluri)\ **Replies:** 4\ **Last updated:** [August 18, 2021, 9:39pm UTC](https://discuss.elastic.co/t/reduce-bulk-rejections/281782 "2021-08-18T21:39:31Z")
Hi, I am performing load testing on a 150 data node elasticsearch cluster (i3.2x AWS instances) so the write thread pool size is 8 and queue size is 200. I am indexing into ES using 20 ecs tasks and each ecs task is us… --- ## [Rollover index at a particular time (UTC ) instead of index creation date](https://discuss.elastic.co/t/rollover-index-at-a-particular-time-utc-instead-of-index-creation-date/281777)
**Author:** [@Madhumitha\_Murali](https://discuss.elastic.co/u/Madhumitha_Murali)\ **Replies:** 1\ **Last updated:** [August 18, 2021, 9:38pm UTC](https://discuss.elastic.co/t/rollover-index-at-a-particular-time-utc-instead-of-index-creation-date/281777 "2021-08-18T21:38:47Z")
Hi All, Need your help with rollover index. I rollover index with conditions max\_age=1d and max\_size=50GB. The max\_age is calculated from the index creation time rather than the date field in the index name. Is there … --- ## [Not able to create delete policy for index](https://discuss.elastic.co/t/not-able-to-create-delete-policy-for-index/281844)
**Author:** [@pratik\_jain163](https://discuss.elastic.co/u/pratik_jain163)\ **Replies:** 2\ **Last updated:** [August 18, 2021, 9:34pm UTC](https://discuss.elastic.co/t/not-able-to-create-delete-policy-for-index/281844 "2021-08-18T21:34:25Z")
I am trying to create a policy from AWS ES kibana dev tool and got this message {"Message":"Your request: '/\_ilm/policy/my\_policy' is not allowed."} PUT \_ilm/policy/my\_policy { "policy": { "phases": { … --- ## ["Restored connection to ES Instance" warning at startup](https://discuss.elastic.co/t/restored-connection-to-es-instance-warning-at-startup/281752)
**Author:** [@panagiss](https://discuss.elastic.co/u/panagiss)\ **Replies:** 4\ **Last updated:** [August 18, 2021, 9:11pm UTC](https://discuss.elastic.co/t/restored-connection-to-es-instance-warning-at-startup/281752 "2021-08-18T21:11:29Z")
At logstash startup i get these weird warnings. Here are the warning: \[2021-08-17T21:33:03,732\]\[WARN \]\[logstash.outputs.elasticsearch\]\[straight-es\] Restored connection to ES instance {:url=\>"https://logstash\_internal:x… --- ## [Set in visualization "greater than X"](https://discuss.elastic.co/t/set-in-visualization-greater-than-x/281398)
**Author:** [@Saliinger](https://discuss.elastic.co/u/Saliinger)\ **Replies:** 2\ **Last updated:** [August 18, 2021, 8:09pm UTC](https://discuss.elastic.co/t/set-in-visualization-greater-than-x/281398 "2021-08-18T20:09:34Z")
Hello! I'm trying to set a TSVB visualization values when it's greather than 1, I mean: When value of this visualization is greather than 1, set it to 1 like an "if-else statements" if (value \>= 1): value = 1 It i… --- ## [EQL sequence query returns strange result](https://discuss.elastic.co/t/eql-sequence-query-returns-strange-result/280082)
**Author:** [@aryon](https://discuss.elastic.co/u/aryon)\ **Replies:** 3\ **Last updated:** [August 18, 2021, 8:09pm UTC](https://discuss.elastic.co/t/eql-sequence-query-returns-strange-result/280082 "2021-08-18T20:09:17Z")
Hello, I have an EQL sequence query in ElasticSearch 7.11.1 that returns strange results: the join\_keys value is different from the user.email that is in the results. Here is the query: GET /my\_index/\_eql/search?filte… --- ## [ILM, shrink index and aliases](https://discuss.elastic.co/t/ilm-shrink-index-and-aliases/281755)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 4\ **Last updated:** [August 18, 2021, 8:07pm UTC](https://discuss.elastic.co/t/ilm-shrink-index-and-aliases/281755 "2021-08-18T20:07:56Z")
Is there a way to get ES to retain aliases of indexes after the index has been shrunk during an ILM rollover. I use the aliases in the kibana discover indexes rather than index name patterns but the new shrunk indexes … --- ## [\[2021-08-18T14:40:31,056\]\[WARhttp client did not trust this server's certificate, closing connection Netty4HttpChannel](https://discuss.elastic.co/t/2021-08-18t1431-056-warhttp-client-did-not-trust-this-servers-certificate-closing-connection-netty4httpchannel/281869)
**Author:** [@mlo](https://discuss.elastic.co/u/mlo)\ **Replies:** 0\ **Last updated:** [August 18, 2021, 7:11pm UTC](https://discuss.elastic.co/t/2021-08-18t1431-056-warhttp-client-did-not-trust-this-servers-certificate-closing-connection-netty4httpchannel/281869 "2021-08-18T19:11:02Z")
Hi, I am working in databricks and had this working and now it stopped without any changes to my code. I am connecting to Elastic with the es-hadoop client via pyspark. Here are my settings .format("org.elasticsearch.… --- ## [How to upgrade Logstash in Filebeat + Logstash pipeline?](https://discuss.elastic.co/t/how-to-upgrade-logstash-in-filebeat-logstash-pipeline/280984)
**Author:** [@GitSpree23](https://discuss.elastic.co/u/GitSpree23)\ **Replies:** 5\ **Last updated:** [August 18, 2021, 7:03pm UTC](https://discuss.elastic.co/t/how-to-upgrade-logstash-in-filebeat-logstash-pipeline/280984 "2021-08-18T19:03:14Z")
I'm working on a system that uses Filebeat (v7.8) with Logstash output (v2.2.4). Filebeat reads files from a specific folder and publishes the data to Logstash which in turn sends the output to RabbitMQ. I need to upgr… --- ## [How to restore an external snapshot](https://discuss.elastic.co/t/how-to-restore-an-external-snapshot/281868)
**Author:** [@yrtqz](https://discuss.elastic.co/u/yrtqz)\ **Replies:** 2\ **Last updated:** [August 18, 2021, 7:02pm UTC](https://discuss.elastic.co/t/how-to-restore-an-external-snapshot/281868 "2021-08-18T19:02:18Z")
Hello, The use case I'm trying to do is as follows: on elasticsearch instance A inside a docker container, a snapshot is taken, and all the relevant snapshot files are copied out of the container and sent in a zip to be… --- ## [How to understand the new registry file in filebeat](https://discuss.elastic.co/t/how-to-understand-the-new-registry-file-in-filebeat/281865)
**Author:** [@Opeyemi\_Onikute](https://discuss.elastic.co/u/Opeyemi_Onikute)\ **Replies:** 0\ **Last updated:** [August 18, 2021, 5:47pm UTC](https://discuss.elastic.co/t/how-to-understand-the-new-registry-file-in-filebeat/281865 "2021-08-18T17:47:17Z")
This is a follow-up to this question about understanding how the registry file works: How to understand "registry" file in filebeat Since version 7, the registry file has changed to a sub-directory structure and I need … --- ## [Adding numeric values of multiple fields into one field](https://discuss.elastic.co/t/adding-numeric-values-of-multiple-fields-into-one-field/281856)
**Author:** [@pkward](https://discuss.elastic.co/u/pkward)\ **Replies:** 2\ **Last updated:** [August 18, 2021, 5:46pm UTC](https://discuss.elastic.co/t/adding-numeric-values-of-multiple-fields-into-one-field/281856 "2021-08-18T17:46:53Z")
Hi, Is there a way to add multiple numeric values of multiple fields and create a "total" field? ''' "Object": { field1: 3 field2: 4 field3: 5 field4: 1 field5: 2 "total": 15 } ''' --- ## ["Cannot copy field \[ \] to fields \[ \]. Copy-to currently only works for value-type fields, not objects](https://discuss.elastic.co/t/cannot-copy-field-to-fields-copy-to-currently-only-works-for-value-type-fields-not-objects/280429)
**Author:** [@moziada](https://discuss.elastic.co/u/moziada)\ **Replies:** 2\ **Last updated:** [August 18, 2021, 11:28am UTC](https://discuss.elastic.co/t/cannot-copy-field-to-fields-copy-to-currently-only-works-for-value-type-fields-not-objects/280429 "2021-08-18T11:28:51Z")
ES = ver 7.14 Linux , mysql 8 The error happens after upgrade to 7.14 from 7.13 the issue : I use Logstash to input to ES from MySQL U used to add null (nil) value to copy\_to field, after upgrade it is not accepte… --- ## [Dedicated voting-only master nodes and repository access](https://discuss.elastic.co/t/dedicated-voting-only-master-nodes-and-repository-access/281787)
**Author:** [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Replies:** 1\ **Last updated:** [August 18, 2021, 5:07pm UTC](https://discuss.elastic.co/t/dedicated-voting-only-master-nodes-and-repository-access/281787 "2021-08-18T17:07:58Z")
If I am deploying an Elasticsearch cluster across 2 on-premise data centres and want to place a dedicated voting-only master node in the cloud as an arbiter, would the dedicated voting-only master node still need access … --- ## [How to delete only one document by its \_id no in kibana](https://discuss.elastic.co/t/how-to-delete-only-one-document-by-its-id-no-in-kibana/281857)
**Author:** [@francieliton\_araujo](https://discuss.elastic.co/u/francieliton_araujo)\ **Replies:** 2\ **Last updated:** [August 18, 2021, 4:55pm UTC](https://discuss.elastic.co/t/how-to-delete-only-one-document-by-its-id-no-in-kibana/281857 "2021-08-18T16:55:19Z")
How to delete only one document by its \_id no in kibana Example: I just want to remove this document: id: 566a17d32bfbfe92df743764ec499321dc20e236d9a09c80305752c34541198d it is in this index: xxx-xxxxxx-xxxxx-xxxx-2… --- ## [How to convert hot induce to cold/warm/hot plus hardware profile change?](https://discuss.elastic.co/t/how-to-convert-hot-induce-to-cold-warm-hot-plus-hardware-profile-change/281809)
**Author:** [@M\_Gibbs](https://discuss.elastic.co/u/M_Gibbs)\ **Replies:** 1\ **Last updated:** [August 18, 2021, 4:34pm UTC](https://discuss.elastic.co/t/how-to-convert-hot-induce-to-cold-warm-hot-plus-hardware-profile-change/281809 "2021-08-18T16:34:09Z")
Hey all, I’m using Elastic Cloud. We have a large data (900+GB)set that we’ve indexed as hot storage on IO hardware profile. This is naturally expensive. What id like to do is two fold: Change the IO profile to Comp… --- ## [ML partition by two fields](https://discuss.elastic.co/t/ml-partition-by-two-fields/281831)
**Author:** [@OmarDacca](https://discuss.elastic.co/u/OmarDacca)\ **Replies:** 2\ **Last updated:** [August 18, 2021, 4:32pm UTC](https://discuss.elastic.co/t/ml-partition-by-two-fields/281831 "2021-08-18T16:32:14Z")
Hi, ES v 7.13.2 I'm trying to create the following ML job and not sure if I'm doing it correctly. indices: user\_events\* every document looks something like: { "date\_time": "2021-07-16T01:00:00.000Z", "client… --- ## [Getting rid of the null value from Lens Table](https://discuss.elastic.co/t/getting-rid-of-the-null-value-from-lens-table/281854)
**Author:** [@bailarch](https://discuss.elastic.co/u/bailarch)\ **Replies:** 0\ **Last updated:** [August 18, 2021, 3:51pm UTC](https://discuss.elastic.co/t/getting-rid-of-the-null-value-from-lens-table/281854 "2021-08-18T15:51:50Z")
Hello everyone, I have a list of projects in the column and a list of users for the rows. I eventually want to make a table where it shows 'who are working on each project' This is my starting point but not sure how t… --- ## [Elasticsearch python client compatibility](https://discuss.elastic.co/t/elasticsearch-python-client-compatibility/281829)
**Author:** [@bruce289](https://discuss.elastic.co/u/bruce289)\ **Replies:** 2\ **Last updated:** [August 18, 2021, 3:50pm UTC](https://discuss.elastic.co/t/elasticsearch-python-client-compatibility/281829 "2021-08-18T15:50:34Z")
Hi, I need to write a python script that can be run against both elasticsearch 6 and elasticsearch 7 clusters. Which version of the python elasticsearch client would be recommended for this purpose? Thanks, Bruce --- ## [Best practice in elasticsearch idnex](https://discuss.elastic.co/t/best-practice-in-elasticsearch-idnex/281815)
**Author:** [@naaviin](https://discuss.elastic.co/u/naaviin)\ **Replies:** 5\ **Last updated:** [August 18, 2021, 3:20pm UTC](https://discuss.elastic.co/t/best-practice-in-elasticsearch-idnex/281815 "2021-08-18T15:20:52Z")
I have few log with some same patter and some different patterh. Log name (same pattern) a.log b.log Log name (different pattern) c.log d.log Environment name env1 env2 env3 Is this good practice for index --MMYY… --- ## [Filebeat/Logstash doesn't send system.auth.\*.\* field data to Elastic Search - v 7.14](https://discuss.elastic.co/t/filebeat-logstash-doesnt-send-system-auth-field-data-to-elastic-search-v-7-14/281793)
**Author:** [@angheladrianclaudiu](https://discuss.elastic.co/u/angheladrianclaudiu)\ **Replies:** 2\ **Last updated:** [August 18, 2021, 3:01pm UTC](https://discuss.elastic.co/t/filebeat-logstash-doesnt-send-system-auth-field-data-to-elastic-search-v-7-14/281793 "2021-08-18T15:01:12Z")
I've installed ELK stack with steps described here: Current Elastic Release (7.14) Current Kibana Release (7.14) Current Logstash Release (7.14) Current Filebeat Release (7.14) I also used the Logstash configuration… --- ## [Filebeat does not process any files after restart](https://discuss.elastic.co/t/filebeat-does-not-process-any-files-after-restart/281536)
**Author:** [@nugroho-expereo](https://discuss.elastic.co/u/nugroho-expereo)\ **Replies:** 6\ **Last updated:** [August 18, 2021, 2:55pm UTC](https://discuss.elastic.co/t/filebeat-does-not-process-any-files-after-restart/281536 "2021-08-18T14:55:12Z")
Hi, We restarted filebeat in our server today and after restarting no new logs are pushed to logstash anymore. Here is the config that we use for the input: filebeat.inputs: - type: log enabled: true paths: - /v… --- ## [Upgrade From 7.3.1 to 7.13.2 causing circuit breaker exceptions / slow performance](https://discuss.elastic.co/t/upgrade-from-7-3-1-to-7-13-2-causing-circuit-breaker-exceptions-slow-performance/281090)
**Author:** [@Justin\_Cross1](https://discuss.elastic.co/u/Justin_Cross1)\ **Replies:** 2\ **Last updated:** [August 18, 2021, 2:48pm UTC](https://discuss.elastic.co/t/upgrade-from-7-3-1-to-7-13-2-causing-circuit-breaker-exceptions-slow-performance/281090 "2021-08-18T14:48:30Z")
We upgraded from 7.3.1 to 7.13.2 using rolling upgrade and performance took a major hit. For example, a search on 7.3.1 that might take 100-200ms is taking 5000ms in 7.13.2. We had to backout the upgrade so we are on 7… --- ## [I'm auto-logged-in as my anonymous user and cannot log in as administrator anymore](https://discuss.elastic.co/t/im-auto-logged-in-as-my-anonymous-user-and-cannot-log-in-as-administrator-anymore/281810)
**Author:** [@nsouth](https://discuss.elastic.co/u/nsouth)\ **Replies:** 2\ **Last updated:** [August 18, 2021, 2:48pm UTC](https://discuss.elastic.co/t/im-auto-logged-in-as-my-anonymous-user-and-cannot-log-in-as-administrator-anymore/281810 "2021-08-18T14:48:33Z")
I added the following to my kibana.yml for the sake of embedding visualizations, but now when I log in to the Kibana web portal, I'm auto-logged-in as dashboard\_viewer and cannot log out or choose to log in as the elast… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1274) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1276)