# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1340 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1341 --- ## [Ingest pipeline add field with date in the future](https://discuss.elastic.co/t/ingest-pipeline-add-field-with-date-in-the-future/277489)
**Author:** [@sam3546](https://discuss.elastic.co/u/sam3546)\ **Replies:** 2\ **Last updated:** [July 1, 2021, 2:11pm UTC](https://discuss.elastic.co/t/ingest-pipeline-add-field-with-date-in-the-future/277489 "2021-07-01T14:11:16Z")
Via an ingest pipeline using a processor such as a script (similar to this) or another processor is it simple to add a field with the date x days (a field on the ingested doc) after its ingested. Such that a doc field:… --- ## [Watcher rule query on the same row data](https://discuss.elastic.co/t/watcher-rule-query-on-the-same-row-data/277463)
**Author:** [@manikandanid](https://discuss.elastic.co/u/manikandanid)\ **Replies:** 1\ **Last updated:** [July 1, 2021, 2:06pm UTC](https://discuss.elastic.co/t/watcher-rule-query-on-the-same-row-data/277463 "2021-07-01T14:06:53Z")
I have a use case where i fetch set of records from elastic search in my Webhook watcher rule. The retrieved records contains two column (say x & y), In the watcher rule body i would like to loop the data and include on… --- ## [Programmatically rename (re-title) Kibana index patterns](https://discuss.elastic.co/t/programmatically-rename-re-title-kibana-index-patterns/277398)
**Author:** [@GrahamHannington](https://discuss.elastic.co/u/GrahamHannington)\ **Replies:** 3\ **Last updated:** [July 1, 2021, 1:40pm UTC](https://discuss.elastic.co/t/programmatically-rename-re-title-kibana-index-patterns/277398 "2021-07-01T13:40:38Z")
I've developed a set of Kibana dashboards that use about a dozen index patterns with the following structure: product\_x-table\_name-\* where product\_x is a fixed string and table\_name has a dozen or so values. Example in… --- ## [Elasticsearch cannot up because /org/freedesktop/PolicyKit1/AuthenticationAgent Blocked](https://discuss.elastic.co/t/elasticsearch-cannot-up-because-org-freedesktop-policykit1-authenticationagent-blocked/277464)
**Author:** [@kemalkolcuoglu](https://discuss.elastic.co/u/kemalkolcuoglu)\ **Replies:** 2\ **Last updated:** [July 1, 2021, 1:18pm UTC](https://discuss.elastic.co/t/elasticsearch-cannot-up-because-org-freedesktop-policykit1-authenticationagent-blocked/277464 "2021-07-01T13:18:11Z")
Hello Everyone, Cluster version: 7.7.0 OS Version: Centos 7.9 Java Version: Java 8 We have an issue with Elasticsearch when we try to up the service. journalctl -xe output: Jun 30 08:59:10 elk-master-2 systemd\[1\]: … --- ## [ES 7.11 Heap Out of memory error](https://discuss.elastic.co/t/es-7-11-heap-out-of-memory-error/277478)
**Author:** [@tmathew](https://discuss.elastic.co/u/tmathew)\ **Replies:** 4\ **Last updated:** [July 1, 2021, 1:01pm UTC](https://discuss.elastic.co/t/es-7-11-heap-out-of-memory-error/277478 "2021-07-01T13:01:04Z")
Hi ! We upgraded from 2.4 to 7.11, we are having below issues all around the ES. ES data nodes are going down alternatively, and it is due to Heap Out of memory issues. Today morning we did re-indexing around 100k/s a… --- ## [How to fetch Kibana APi logs in Dashboard using Powershell](https://discuss.elastic.co/t/how-to-fetch-kibana-api-logs-in-dashboard-using-powershell/277369)
**Author:** [@Sahithi\_V](https://discuss.elastic.co/u/Sahithi_V)\ **Replies:** 2\ **Last updated:** [July 1, 2021, 12:34pm UTC](https://discuss.elastic.co/t/how-to-fetch-kibana-api-logs-in-dashboard-using-powershell/277369 "2021-07-01T12:34:43Z")
Recently part of automation we are trying to fetch kibana dashboard apis through any script lang ie Python /powershell . Tried to fetch with Rest APis, but through unable to connect. Server of Elastic search looks somet… --- ## [Function from filter block](https://discuss.elastic.co/t/function-from-filter-block/277547)
**Author:** [@Velly](https://discuss.elastic.co/u/Velly)\ **Replies:** 0\ **Last updated:** [July 1, 2021, 11:46am UTC](https://discuss.elastic.co/t/function-from-filter-block/277547 "2021-07-01T11:46:10Z")
Hello! I am a new user of ELK. I am trying to understand how works SIEM parser «1». In filter block I see: filter { load\_source\_mapper\_filters(mcsevt). Mcs is service of agent that picks up Windows logs. I don’t un… --- ## [Cirrus Search setting with elastic search in mediawiki , not showing auto suggest when typing in search engine](https://discuss.elastic.co/t/cirrus-search-setting-with-elastic-search-in-mediawiki-not-showing-auto-suggest-when-typing-in-search-engine/277546)
**Author:** [@Pooja\_Sharma](https://discuss.elastic.co/u/Pooja_Sharma)\ **Replies:** 0\ **Last updated:** [July 1, 2021, 11:38am UTC](https://discuss.elastic.co/t/cirrus-search-setting-with-elastic-search-in-mediawiki-not-showing-auto-suggest-when-typing-in-search-engine/277546 "2021-07-01T11:38:29Z")
Hi iam using, MediaWiki1.35.1 \[PHP\]7.4.15 \[Elasticsearch\] 6.5.4 Iam geeting result from my search engine.But ,not showing auto suggest when typing in search engine. In console iam able to see error {"error":{"code":… --- ## [Logstash problems with fields (Point to Point)](https://discuss.elastic.co/t/logstash-problems-with-fields-point-to-point/277196)
**Author:** [@Michael\_Dylan\_McAloo](https://discuss.elastic.co/u/Michael_Dylan_McAloo)\ **Replies:** 2\ **Last updated:** [July 1, 2021, 11:23am UTC](https://discuss.elastic.co/t/logstash-problems-with-fields-point-to-point/277196 "2021-07-01T11:23:29Z")
I have a problem, I have two IPs one source and one destination, for the source IP Logstash automatically creates a field called "geoip.location" that contains the latitude and longitude of the specific IP, but for the d… --- ## [Hide time interval text](https://discuss.elastic.co/t/hide-time-interval-text/277431)
**Author:** [@Mik\_a](https://discuss.elastic.co/u/Mik_a)\ **Replies:** 8\ **Last updated:** [July 1, 2021, 11:19am UTC](https://discuss.elastic.co/t/hide-time-interval-text/277431 "2021-07-01T11:19:27Z")
I want to have a table showing the created at date for the data and would like to customize the text for the time interval. How do I hide the "per week", "per month" and so on? I want to only show the label --- ## [Tomcat logs in filebeat](https://discuss.elastic.co/t/tomcat-logs-in-filebeat/277313)
**Author:** [@Prasanth\_V](https://discuss.elastic.co/u/Prasanth_V)\ **Replies:** 5\ **Last updated:** [July 1, 2021, 11:03am UTC](https://discuss.elastic.co/t/tomcat-logs-in-filebeat/277313 "2021-07-01T11:03:26Z")
If I add a tomcat log paths in tomcat.yml..why is it not showing in discover section..could you pls give the solution on this case?? --- ## [Kibana multiple conditions not working](https://discuss.elastic.co/t/kibana-multiple-conditions-not-working/277539)
**Author:** [@PatrikM](https://discuss.elastic.co/u/PatrikM)\ **Replies:** 0\ **Last updated:** [July 1, 2021, 10:25am UTC](https://discuss.elastic.co/t/kibana-multiple-conditions-not-working/277539 "2021-07-01T10:25:56Z")
My Kibana version is 7.9.3 Every 60 seconds I'm sending data to elasticsearch. I can see those logs in the observability log section and the series of logs that should trigger the alert, but when I create the alert it … --- ## [Query\_string with "fields" option behaves unexpectedly](https://discuss.elastic.co/t/query-string-with-fields-option-behaves-unexpectedly/277529)
**Author:** [@andreas123](https://discuss.elastic.co/u/andreas123)\ **Replies:** 1\ **Last updated:** [July 1, 2021, 10:30am UTC](https://discuss.elastic.co/t/query-string-with-fields-option-behaves-unexpectedly/277529 "2021-07-01T10:30:26Z")
Hey, i would like to understand why my search query behaves that unexpectedly. I have an index with 3 docs: { "\_index" : "test\_index", "\_type" : "\_doc", "\_id" : "2", "\_score" : 1.0, … --- ## [Index not deleting according ilm policy](https://discuss.elastic.co/t/index-not-deleting-according-ilm-policy/276265)
**Author:** [@vikramdayma](https://discuss.elastic.co/u/vikramdayma)\ **Replies:** 11\ **Last updated:** [July 1, 2021, 10:30am UTC](https://discuss.elastic.co/t/index-not-deleting-according-ilm-policy/276265 "2021-07-01T10:30:04Z")
Hi, I created an ILM policy and applied to system index (.monitoring-es-7-2021.06.10). But index is not deleting after ILM time. It is showing error. illegal\_argument\_exception: setting \[index.lifecycle.rollover\_alia… --- ## [Flatten Array in Ingest Pipeline with Painless](https://discuss.elastic.co/t/flatten-array-in-ingest-pipeline-with-painless/277383)
**Author:** [@nicjp](https://discuss.elastic.co/u/nicjp)\ **Replies:** 2\ **Last updated:** [July 1, 2021, 10:15am UTC](https://discuss.elastic.co/t/flatten-array-in-ingest-pipeline-with-painless/277383 "2021-07-01T10:15:58Z")
Hi all, I'm working on getting some logs onboarded and I'm having an issue with a field that contains Key/Values inside an array. (For reference please see below) { "redis\_cache\_read\_bytes": 741, "format": "json", … --- ## [\[Auditbeat\] Monitoring of files/folders with a space in the path not possible](https://discuss.elastic.co/t/auditbeat-monitoring-of-files-folders-with-a-space-in-the-path-not-possible/277537)
**Author:** [@SECUINFRA](https://discuss.elastic.co/u/SECUINFRA)\ **Replies:** 0\ **Last updated:** [July 1, 2021, 10:10am UTC](https://discuss.elastic.co/t/auditbeat-monitoring-of-files-folders-with-a-space-in-the-path-not-possible/277537 "2021-07-01T10:10:25Z")
Hi, the monitoring of files/folders with a space in the path was not possible using auditbeat (version 7.13): The following rules all resulted in errors: -w /tmp/folder with space -p r -k test1 -w "/tmp/folder with sp… --- ## [Why we need index template?](https://discuss.elastic.co/t/why-we-need-index-template/277523)
**Author:** [@Nisha2297](https://discuss.elastic.co/u/Nisha2297)\ **Replies:** 6\ **Last updated:** [July 1, 2021, 9:26am UTC](https://discuss.elastic.co/t/why-we-need-index-template/277523 "2021-07-01T09:26:51Z")
Why we need to create index template when we can simply define the fields and there datatype in the logstash itself using below syntax: mutate {convert =\> \["field\_name", "data\_type"\] --- ## [Kibana advanced search split by](https://discuss.elastic.co/t/kibana-advanced-search-split-by/277473)
**Author:** [@Alex112345](https://discuss.elastic.co/u/Alex112345)\ **Replies:** 2\ **Last updated:** [July 1, 2021, 7:42am UTC](https://discuss.elastic.co/t/kibana-advanced-search-split-by/277473 "2021-07-01T07:42:12Z")
Hi all, I'm quite new to Elastic & Kibana. I've used Splunk in the past and I was wondering if someone could point me in the right direction to do something as below Let's say we have an indexed field called users. The… --- ## [Config Error 403: "error":{"message":"blocked by: \[FORBIDDEN/8/index write (api)\];: \[cluster\_block\_exception\] blocked by: \[FORBIDDEN/8/index write (api)\];","name":"Error","stack":"\[cluster\_block\_exception\] blocked by: \[FORBIDDEN/8/index write (api)\]](https://discuss.elastic.co/t/config-error-403-error-message-blocked-by-forbidden-8-index-write-api-cluster-block-exception-blocked-by-forbidden-8-index-write-api-name-error-stack-cluster-block-exception-blocked-by-forbidden-8-index-write-api/277512)
**Author:** [@Ashish\_Manjrekar](https://discuss.elastic.co/u/Ashish_Manjrekar)\ **Replies:** 2\ **Last updated:** [July 1, 2021, 7:31am UTC](https://discuss.elastic.co/t/config-error-403-error-message-blocked-by-forbidden-8-index-write-api-cluster-block-exception-blocked-by-forbidden-8-index-write-api-name-error-stack-cluster-block-exception-blocked-by-forbidden-8-index-write-api/277512 "2021-07-01T07:31:58Z")
Can someone help me understand the below issue. Also, if any resolution available. {"type":"error","@timestamp":"2021-04-25T01:41:28Z","tags":,"pid":3076,"level":"error","error":{"message":"blocked by: \[FORBIDDEN/8/inde… --- ## [Resolved attribute is missing ... but is not!](https://discuss.elastic.co/t/resolved-attribute-is-missing-but-is-not/277510)
**Author:** [@priamai](https://discuss.elastic.co/u/priamai)\ **Replies:** 1\ **Last updated:** [July 1, 2021, 6:07am UTC](https://discuss.elastic.co/t/resolved-attribute-is-missing-but-is-not/277510 "2021-07-01T06:07:53Z")
I am on ELK 7.13.0 with the Hadoop 7.13.0 library. I have the following schema: root |-- @timestamp: timestamp (nullable = true) |-- AuthenticationPackage: string (nullable = true) |-- Destination: string (nullable … --- ## [Monitoring API query](https://discuss.elastic.co/t/monitoring-api-query/277200)
**Author:** [@priamai](https://discuss.elastic.co/u/priamai)\ **Replies:** 3\ **Last updated:** [July 1, 2021, 5:30am UTC](https://discuss.elastic.co/t/monitoring-api-query/277200 "2021-07-01T05:30:31Z")
Hi there, I am with ELK 7.13.0 the basic free licence. Is there a way to monitor the queries that are performed via the Elastic API? Even to keep the last N most recent ones for example. I basically have different pyt… --- ## [Kibana dashboard shards failed](https://discuss.elastic.co/t/kibana-dashboard-shards-failed/277285)
**Author:** [@Amudhan\_P](https://discuss.elastic.co/u/Amudhan_P)\ **Replies:** 5\ **Last updated:** [July 1, 2021, 5:28am UTC](https://discuss.elastic.co/t/kibana-dashboard-shards-failed/277285 "2021-07-01T05:28:25Z")
Hi, I am running an ELK cluster in Elastic.io I am having a problem in Kibana, visualization it's showing shards failed. Visualization is been configured to show a field from my APM data. I don't find any error msg fr… --- ## [Unable to install kibana-plugin](https://discuss.elastic.co/t/unable-to-install-kibana-plugin/277304)
**Author:** [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)\ **Replies:** 4\ **Last updated:** [July 1, 2021, 5:27am UTC](https://discuss.elastic.co/t/unable-to-install-kibana-plugin/277304 "2021-07-01T05:27:28Z")
Hello team, I am unable to install kibana plugin on my local. Can you please help me on this OS: Windows Kiban Version: 7.9 Below is the error: PS C:\\WINDOWS\\system32\> cd C:\\Users\\mangeshsuresh.jadhav\\Downloads\\EKL\\… --- ## [Logstash not listening to 5044](https://discuss.elastic.co/t/logstash-not-listening-to-5044/277432)
**Author:** [@azid](https://discuss.elastic.co/u/azid)\ **Replies:** 2\ **Last updated:** [July 1, 2021, 4:21am UTC](https://discuss.elastic.co/t/logstash-not-listening-to-5044/277432 "2021-07-01T04:21:54Z")
Hi Im new to ELK, when I try to transfert data filebeat -\>logstash I got my logstash not listening to port 5044 any help would be appreciated Pipeline : input { beats { port =\> 5044 } } filter { gro… --- ## [Max number of shard a elastic node can hold](https://discuss.elastic.co/t/max-number-of-shard-a-elastic-node-can-hold/277434)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 5\ **Last updated:** [July 1, 2021, 4:17am UTC](https://discuss.elastic.co/t/max-number-of-shard-a-elastic-node-can-hold/277434 "2021-07-01T04:17:59Z")
Hi all What is the max number of shard that an elastic node can hold. and i dont mean per index or anything i mean the max number of shard for all index that a node can hold. --- ## [Jdbc\_static prepared statement error](https://discuss.elastic.co/t/jdbc-static-prepared-statement-error/277507)
**Author:** [@metalshanked](https://discuss.elastic.co/u/metalshanked)\ **Replies:** 0\ **Last updated:** [July 1, 2021, 3:37am UTC](https://discuss.elastic.co/t/jdbc-static-prepared-statement-error/277507 "2021-07-01T03:37:51Z")
Hello, I have the below jdbc\_static lookup statement but it seems to fail with the error:- exception=\>#\,… --- ## [Elasticsearch is down and data are messing, how to recover it!](https://discuss.elastic.co/t/elasticsearch-is-down-and-data-are-messing-how-to-recover-it/277202)
**Author:** [@bab](https://discuss.elastic.co/u/bab)\ **Replies:** 3\ **Last updated:** [July 1, 2021, 2:06am UTC](https://discuss.elastic.co/t/elasticsearch-is-down-and-data-are-messing-how-to-recover-it/277202 "2021-07-01T02:06:31Z")
Hey, how can I recover data that I lost while my Elasticsearch was down. see the screen below. thank you. --- ## [Add date math support in index-pattern for rollup job](https://discuss.elastic.co/t/add-date-math-support-in-index-pattern-for-rollup-job/277321)
**Author:** [@wangqinghuan](https://discuss.elastic.co/u/wangqinghuan)\ **Replies:** 0\ **Last updated:** [June 29, 2021, 8:31am UTC](https://discuss.elastic.co/t/add-date-math-support-in-index-pattern-for-rollup-job/277321 "2021-06-29T08:31:37Z")
Currently, we can specify index-pattern to match a series of daily indices when create a rollup job. However, when a lot of indices exists in Elasticsearch, rollup job will scan all exists indices to filter data although… --- ## [Delete Index from Cluster State](https://discuss.elastic.co/t/delete-index-from-cluster-state/277343)
**Author:** [@daksh0225](https://discuss.elastic.co/u/daksh0225)\ **Replies:** 1\ **Last updated:** [July 1, 2021, 2:02am UTC](https://discuss.elastic.co/t/delete-index-from-cluster-state/277343 "2021-07-01T02:02:05Z")
Hello!! I am trying to ensure that indices created during testing do not persist in elasticsearch when it is restarted. To achieve this, I have modiifed the doStop() function of IndicesService in the following manner: … --- ## [Elasticsearch heap Memory WARNING in elk docker](https://discuss.elastic.co/t/elasticsearch-heap-memory-warning-in-elk-docker/277419)
**Author:** [@ranu\_shekhar](https://discuss.elastic.co/u/ranu_shekhar)\ **Replies:** 4\ **Last updated:** [July 1, 2021, 1:53am UTC](https://discuss.elastic.co/t/elasticsearch-heap-memory-warning-in-elk-docker/277419 "2021-07-01T01:53:15Z")
Hi, I am using elasticsearch 7.10.0. I have 3 nodes in my cluster. But in one of the node among 3, we are receiving given below warning logs: \*\*{"type": "server", "timestamp": "2021-06-30T04:01:53,805Z", "level": "WAR… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1339) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1341)