# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1335 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1336 --- ## [Update template and force rollover](https://discuss.elastic.co/t/update-template-and-force-rollover/277886)
**Author:** [@dimitris\_sb](https://discuss.elastic.co/u/dimitris_sb)\ **Replies:** 0\ **Last updated:** [July 5, 2021, 11:11pm UTC](https://discuss.elastic.co/t/update-template-and-force-rollover/277886 "2021-07-05T23:11:06Z")
Hi All, Is it possible after applying a new template to ILM (with rollover every x GB or y days) managed indices, to force rollover? Could I use the rollover API in order to create new indices which will follow the cha… --- ## [ILM and custom index names](https://discuss.elastic.co/t/ilm-and-custom-index-names/277563)
**Author:** [@muhdiekuh](https://discuss.elastic.co/u/muhdiekuh)\ **Replies:** 3\ **Last updated:** [July 5, 2021, 11:25pm UTC](https://discuss.elastic.co/t/ilm-and-custom-index-names/277563 "2021-07-05T23:25:03Z")
Hi, I'm using ILM with filebeat. Right now I'm using the default configuration. I'd like to adjust it a little bit now, but I'm not sure if what I want to do is actually possible. I'd like to have a separate index for … --- ## [Install Elasticsearch on Ubuntu Core](https://discuss.elastic.co/t/install-elasticsearch-on-ubuntu-core/277559)
**Author:** [@vadd98](https://discuss.elastic.co/u/vadd98)\ **Replies:** 3\ **Last updated:** [July 5, 2021, 11:23pm UTC](https://discuss.elastic.co/t/install-elasticsearch-on-ubuntu-core/277559 "2021-07-05T23:23:42Z")
Hi there, I'm working on a project using a Raspberry Pi 4 and Ubuntu Core. I need to use Elasticsearch for my project, but I'm being blocked by the need to install Elasticsearch using Snap. I can't find any Elasticsear… --- ## [Elastic.console unable to connect](https://discuss.elastic.co/t/elastic-console-unable-to-connect/277865)
**Author:** [@Sahithi\_V](https://discuss.elastic.co/u/Sahithi_V)\ **Replies:** 0\ **Last updated:** [July 5, 2021, 4:22pm UTC](https://discuss.elastic.co/t/elastic-console-unable-to-connect/277865 "2021-07-05T16:22:34Z")
Continuing the discussion from ElasticSearch Query with Powershell Invoke-RestMethod: hi @forloop/ Paul, I tried the same module ie elastic.console to invoke web request using PS \> es http://172.44.222.44:5601/\_cat/in… --- ## [Kibana Discover view is very slow after upgrade - not compressing HTTP responses](https://discuss.elastic.co/t/kibana-discover-view-is-very-slow-after-upgrade-not-compressing-http-responses/276991)
**Author:** [@salvoj](https://discuss.elastic.co/u/salvoj)\ **Replies:** 9\ **Last updated:** [July 5, 2021, 8:28pm UTC](https://discuss.elastic.co/t/kibana-discover-view-is-very-slow-after-upgrade-not-compressing-http-responses/276991 "2021-07-05T20:28:34Z")
We have updated from 7.4.0 to 7.13.2 a few days ago. Performance in Discover view has greatly deteriorated. Query times are still good. Problem seems to be the long time it takes to render page: Query time: 1.3 sec T… --- ## [Winlogbeat Sysmon Configuration Registry fields seems to map the wrong value of the registry](https://discuss.elastic.co/t/winlogbeat-sysmon-configuration-registry-fields-seems-to-map-the-wrong-value-of-the-registry/277879)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 0\ **Last updated:** [July 5, 2021, 7:45pm UTC](https://discuss.elastic.co/t/winlogbeat-sysmon-configuration-registry-fields-seems-to-map-the-wrong-value-of-the-registry/277879 "2021-07-05T19:45:55Z")
Hello, Second try.. (Winlogbeat Sysmon Configuration Registry fields seems to map the wrong value of the registry) Just noticed something weird with Sysmon configuration in 7.11 (registry events) As you can see, th… --- ## [Gzip compression results to uncompressable package](https://discuss.elastic.co/t/gzip-compression-results-to-uncompressable-package/277867)
**Author:** [@yodog](https://discuss.elastic.co/u/yodog)\ **Replies:** 1\ **Last updated:** [July 5, 2021, 6:49pm UTC](https://discuss.elastic.co/t/gzip-compression-results-to-uncompressable-package/277867 "2021-07-05T18:49:41Z")
so, after a few years, any way to work around this problem? same problem on logstash 7.13.1 zgrep '2021' zimbra.log.2021-01-30-1613154813.gz gzip: zimbra.log.2021-01-30-1613154813.gz: invalid compressed data--forma… --- ## [Linking separate log records](https://discuss.elastic.co/t/linking-separate-log-records/276680)
**Author:** [@kibanaquery](https://discuss.elastic.co/u/kibanaquery)\ **Replies:** 2\ **Last updated:** [July 5, 2021, 6:16pm UTC](https://discuss.elastic.co/t/linking-separate-log-records/276680 "2021-07-05T18:16:21Z")
Hi, I was wondering if is possible to perform a basic link function (either in Discover or Visualise)? All my records have a common identifier, say "LinkID", but only some records have "Type" and only some have "Colour… --- ## [Deleting Index and Reclaiming Space](https://discuss.elastic.co/t/deleting-index-and-reclaiming-space/277858)
**Author:** [@cis4life](https://discuss.elastic.co/u/cis4life)\ **Replies:** 2\ **Last updated:** [July 5, 2021, 5:03pm UTC](https://discuss.elastic.co/t/deleting-index-and-reclaiming-space/277858 "2021-07-05T17:03:53Z")
Good Day, I have an a couple pretty big indexes that I need to delete. I know I can delete an index by using DELETE myindex the question is by simplying using the DELETE myindex command, will that be enough to delete t… --- ## [Elasticsearch 7.13 - monitoring execution failed](https://discuss.elastic.co/t/elasticsearch-7-13-monitoring-execution-failed/277334)
**Author:** [@Xor44](https://discuss.elastic.co/u/Xor44)\ **Replies:** 5\ **Last updated:** [July 5, 2021, 4:38pm UTC](https://discuss.elastic.co/t/elasticsearch-7-13-monitoring-execution-failed/277334 "2021-07-05T16:38:13Z")
Hi Folks , I have lot of issue with my ELK Stack . This stack is composed of 3 nodes ( Master , Data , Data ) . Logs are populated with the following errors . When I'm trying to make a transform on an index it's failed … --- ## [Http poller plugin automatically splits json response](https://discuss.elastic.co/t/http-poller-plugin-automatically-splits-json-response/277859)
**Author:** [@pjohnson](https://discuss.elastic.co/u/pjohnson)\ **Replies:** 0\ **Last updated:** [July 5, 2021, 3:54pm UTC](https://discuss.elastic.co/t/http-poller-plugin-automatically-splits-json-response/277859 "2021-07-05T15:54:01Z")
I'm using the http\_poller plugin with an endpoint that returns a json array and then I'm processing the response in a ruby script. It seems like http\_poller is automatically splitting the body into separate events for ea… --- ## [HTML in Kibana email action](https://discuss.elastic.co/t/html-in-kibana-email-action/277093)
**Author:** [@sireesha\_m](https://discuss.elastic.co/u/sireesha_m)\ **Replies:** 1\ **Last updated:** [July 5, 2021, 3:18pm UTC](https://discuss.elastic.co/t/html-in-kibana-email-action/277093 "2021-07-05T15:18:08Z")
I have Kibana email action being triggered as a web hook from my Elastic watcher. The doc says markdown is supported. I have added the following for email payload: \`\`"message": "New alert created for asset motor\_pump\_… --- ## [Main problem with garbage collector](https://discuss.elastic.co/t/main-problem-with-garbage-collector/277656)
**Author:** [@angelogabeira](https://discuss.elastic.co/u/angelogabeira)\ **Replies:** 8\ **Last updated:** [July 5, 2021, 3:17pm UTC](https://discuss.elastic.co/t/main-problem-with-garbage-collector/277656 "2021-07-05T15:17:02Z")
guys, I really need help. I've researched a lot on the internet but I couldn't help myself. I have an ELK stack with an elasticsearch 6.5 server, running for 3 years. lately i have had a lot of problem with ingesting da… --- ## [HTTP Filter - Unnest Array](https://discuss.elastic.co/t/http-filter-unnest-array/277778)
**Author:** [@RoteEdition](https://discuss.elastic.co/u/RoteEdition)\ **Replies:** 2\ **Last updated:** [July 5, 2021, 2:22pm UTC](https://discuss.elastic.co/t/http-filter-unnest-array/277778 "2021-07-05T14:22:17Z")
Hi there, I need to unnest an array (based on the workaround mentioned in this previous thread) into seperate documents. I am calling an API and getting in return an array of results. Each of these results should prefe… --- ## [Gauge element issue with SQL query data](https://discuss.elastic.co/t/gauge-element-issue-with-sql-query-data/275884)
**Author:** [@qlikq](https://discuss.elastic.co/u/qlikq)\ **Replies:** 3\ **Last updated:** [July 5, 2021, 2:21pm UTC](https://discuss.elastic.co/t/gauge-element-issue-with-sql-query-data/275884 "2021-07-05T14:21:47Z")
Hello all, i am just starting with ELK, and i am struggling with understanding this part. Could someone point to some documentation, or explain what i am doing wrong ? I have create a gauge element, in the Data portion … --- ## [Kibana running slowly](https://discuss.elastic.co/t/kibana-running-slowly/277796)
**Author:** [@Andrea\_Bozzano](https://discuss.elastic.co/u/Andrea_Bozzano)\ **Replies:** 1\ **Last updated:** [July 5, 2021, 1:02pm UTC](https://discuss.elastic.co/t/kibana-running-slowly/277796 "2021-07-05T13:02:20Z")
Hi everyone, I'm experiencing something in my test environment (1 master and 2 data nodes Elasticsearch, and 1machine with Logstash and Kibana, with enough resources for each node, v7.12 of the stack). When I login int… --- ## [Logstash buff/cache high utilization linux](https://discuss.elastic.co/t/logstash-buff-cache-high-utilization-linux/277836)
**Author:** [@Adixon\_Diaz](https://discuss.elastic.co/u/Adixon_Diaz)\ **Replies:** 0\ **Last updated:** [July 5, 2021, 12:57pm UTC](https://discuss.elastic.co/t/logstash-buff-cache-high-utilization-linux/277836 "2021-07-05T12:57:17Z")
Hi comunity, I'm seeing the utilization resources on my S.O Linux that I only use for Logstash. I could see that the buff/cache is very high. In another hand i would like to know if i configured correctly the utiliz… --- ## [Rerun transforms](https://discuss.elastic.co/t/rerun-transforms/277801)
**Author:** [@alexs1](https://discuss.elastic.co/u/alexs1)\ **Replies:** 1\ **Last updated:** [July 5, 2021, 12:56pm UTC](https://discuss.elastic.co/t/rerun-transforms/277801 "2021-07-05T12:56:47Z")
Hello, Is there any way to run the transform again? for example for the last 24 hours. the naive aproch will be to stop the transform, delete the data from the dest index(is that required), and recreate it with a rang… --- ## [Systemctl failing to start elasticsearch](https://discuss.elastic.co/t/systemctl-failing-to-start-elasticsearch/277220)
**Author:** [@bnason](https://discuss.elastic.co/u/bnason)\ **Replies:** 4\ **Last updated:** [July 5, 2021, 12:18pm UTC](https://discuss.elastic.co/t/systemctl-failing-to-start-elasticsearch/277220 "2021-07-05T12:18:25Z")
After upgrading to 7.13.2 from 7.12.1, using systemctl to start elasticsearch fails. \[root@elastic elasticsearch\]# systemctl status elasticsearch -l ● elasticsearch.service - Elasticsearch Loaded: loaded (/usr/lib/sy… --- ## [Metricbeat: "More than one write index" errors in version 7.13.x](https://discuss.elastic.co/t/metricbeat-more-than-one-write-index-errors-in-version-7-13-x/275355)
**Author:** [@bwright1558](https://discuss.elastic.co/u/bwright1558)\ **Replies:** 6\ **Last updated:** [July 5, 2021, 12:03pm UTC](https://discuss.elastic.co/t/metricbeat-more-than-one-write-index-errors-in-version-7-13-x/275355 "2021-07-05T12:03:47Z")
Ever since upgrading the elastic stack from 7.12.1 to 7.13.x, we've been getting frequent hang ups with running metricbeat (or any other beat) due to the following error: 2021-06-08T22:01:05.930Z ERROR \[index-management… --- ## [Metricbeat - collects the dockers memory size which is different from “docker stats”](https://discuss.elastic.co/t/metricbeat-collects-the-dockers-memory-size-which-is-different-from-docker-stats/277830)
**Author:** [@SperChung-11](https://discuss.elastic.co/u/SperChung-11)\ **Replies:** 0\ **Last updated:** [July 5, 2021, 12:01pm UTC](https://discuss.elastic.co/t/metricbeat-collects-the-dockers-memory-size-which-is-different-from-docker-stats/277830 "2021-07-05T12:01:35Z")
Hi，I have met a problem as follows： i have use metricbeat to collect docker memory, but found that the data of memory (suce as memory usage) was different from the "docker stats", is it right ? metricbeat: 7.6.0 --- ## [Enrich policy match using wildcard or fuzzy search](https://discuss.elastic.co/t/enrich-policy-match-using-wildcard-or-fuzzy-search/277374)
**Author:** [@sam3546](https://discuss.elastic.co/u/sam3546)\ **Replies:** 1\ **Last updated:** [July 5, 2021, 11:45am UTC](https://discuss.elastic.co/t/enrich-policy-match-using-wildcard-or-fuzzy-search/277374 "2021-07-05T11:45:58Z")
I have an ingest pipeline with an enrich policy and separate index (index B) Index B has entries that have a url and a number For each document i ingest via the pipeline i want to match with an entry in index B and ret… --- ## [Microsoft DNS - parsing different length of domain name](https://discuss.elastic.co/t/microsoft-dns-parsing-different-length-of-domain-name/277430)
**Author:** [@gmaimbourg](https://discuss.elastic.co/u/gmaimbourg)\ **Replies:** 4\ **Last updated:** [July 5, 2021, 11:45am UTC](https://discuss.elastic.co/t/microsoft-dns-parsing-different-length-of-domain-name/277430 "2021-07-05T11:45:32Z")
Hello, I'am working on Microsoft DNS log parsing and i don't know how can i parse different lengh of domain name. Here is different examples of what i want to get : (2)ui(12)powerreviews(3)com(0) into ui.powerreviews.… --- ## [How bucket the count into per second](https://discuss.elastic.co/t/how-bucket-the-count-into-per-second/277774)
**Author:** [@missylearner](https://discuss.elastic.co/u/missylearner)\ **Replies:** 2\ **Last updated:** [July 5, 2021, 11:21am UTC](https://discuss.elastic.co/t/how-bucket-the-count-into-per-second/277774 "2021-07-05T11:21:43Z")
Anyone knows how to query in the script to bucket the counts into seconds. because in kibana if we filter timestamp of the count by seconds it will automatically scale to 5 seconds. --- ## [\[400\] Bad request - Parsing Error on /\_field\_caps](https://discuss.elastic.co/t/400-bad-request-parsing-error-on-field-caps/275303)
**Author:** [@bcros](https://discuss.elastic.co/u/bcros)\ **Replies:** 1\ **Last updated:** [July 5, 2021, 11:04am UTC](https://discuss.elastic.co/t/400-bad-request-parsing-error-on-field-caps/275303 "2021-07-05T11:04:50Z")
Hello, After \_reindex, i have the HTTP 400 error with response below, when trying to call /\_field\_caps?fields=\* or /target/\_field\_caps?fields=\*, whatever target is. Anyone have an idea how to fix this ? Did i miss so… --- ## [Transform stability](https://discuss.elastic.co/t/transform-stability/274870)
**Author:** [@alexs1](https://discuss.elastic.co/u/alexs1)\ **Replies:** 19\ **Last updated:** [July 5, 2021, 10:28am UTC](https://discuss.elastic.co/t/transform-stability/274870 "2021-07-05T10:28:40Z")
Hello I've started to use transforms, and they are great- saving lots of pain of using external tools. What concerns me, is the I had few times a load on the cluster, which caused a node to leave the cluster, and cause… --- ## [How far ACID properties are supported](https://discuss.elastic.co/t/how-far-acid-properties-are-supported/277802)
**Author:** [@sarthaksahu](https://discuss.elastic.co/u/sarthaksahu)\ **Replies:** 3\ **Last updated:** [July 5, 2021, 10:08am UTC](https://discuss.elastic.co/t/how-far-acid-properties-are-supported/277802 "2021-07-05T10:08:57Z")
How far ACID properties are supported by Elastic Search. --- ## [Restore updated transform](https://discuss.elastic.co/t/restore-updated-transform/277781)
**Author:** [@alexs1](https://discuss.elastic.co/u/alexs1)\ **Replies:** 2\ **Last updated:** [July 5, 2021, 10:04am UTC](https://discuss.elastic.co/t/restore-updated-transform/277781 "2021-07-05T10:04:05Z")
Hello, Is there any option to restore an updated transform to previous definition before the update? (source/sync etc) thank you --- ## [\_update\_by\_query can't fill subfields in some documents](https://discuss.elastic.co/t/update-by-query-cant-fill-subfields-in-some-documents/277804)
**Author:** [@\_anton](https://discuss.elastic.co/u/_anton)\ **Replies:** 0\ **Last updated:** [July 5, 2021, 9:46am UTC](https://discuss.elastic.co/t/update-by-query-cant-fill-subfields-in-some-documents/277804 "2021-07-05T09:46:19Z")
After dinamically updating index mapping (I added new subfield with a lowercase normaliizer), I ran an \_update\_by\_query task to fill subfield with normalized values. However the task doesn't create subfield for several d… --- ## [Kibana Monitoring with Metricbeat](https://discuss.elastic.co/t/kibana-monitoring-with-metricbeat/277660)
**Author:** [@spike83](https://discuss.elastic.co/u/spike83)\ **Replies:** 3\ **Last updated:** [July 5, 2021, 9:44am UTC](https://discuss.elastic.co/t/kibana-monitoring-with-metricbeat/277660 "2021-07-05T09:44:33Z")
Hi, I'm trying to monitor Kibana using metricbeat - pretty standard Im having an issue where Metricbeat is getting a forbidden response from the Kibana URL. I have tested using an curl with the same credentials and it … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1334) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1336)