# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1376 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1377 --- ## [How searching over multiple indices using alias work internally, is it faster that having one index having all the documents](https://discuss.elastic.co/t/how-searching-over-multiple-indices-using-alias-work-internally-is-it-faster-that-having-one-index-having-all-the-documents/275372)
**Author:** [@code\_merchant](https://discuss.elastic.co/u/code_merchant)\ **Replies:** 1\ **Last updated:** [June 9, 2021, 7:56am UTC](https://discuss.elastic.co/t/how-searching-over-multiple-indices-using-alias-work-internally-is-it-faster-that-having-one-index-having-all-the-documents/275372 "2021-06-09T07:56:37Z")
I have 2 clusters. Cluster A: have 1 big index storing 500 GB of data Cluster B: have monthly indices of 30GB for 15 months There is a search query which search over a single index in cluster A and over read-alias \[im… --- ## [Exclude\_Files not working in Filebeat](https://discuss.elastic.co/t/exclude-files-not-working-in-filebeat/275392)
**Author:** [@shubham.tawde](https://discuss.elastic.co/u/shubham.tawde)\ **Replies:** 0\ **Last updated:** [June 9, 2021, 7:51am UTC](https://discuss.elastic.co/t/exclude-files-not-working-in-filebeat/275392 "2021-06-09T07:51:13Z")
Hi there! I have been trying to exclude a file from a directory, here's the dir structure which I have- var/logs/domain-a/HSC1/HSC1/logger.log var/logs/domain-b/HSC2/HSC2/logger.log var/logs/domain-c/HSC3/HSC3/logger… --- ## [Embed custom plugin in another custom plugin](https://discuss.elastic.co/t/embed-custom-plugin-in-another-custom-plugin/275165)
**Author:** [@jackson123](https://discuss.elastic.co/u/jackson123)\ **Replies:** 4\ **Last updated:** [June 9, 2021, 7:47am UTC](https://discuss.elastic.co/t/embed-custom-plugin-in-another-custom-plugin/275165 "2021-06-09T07:47:15Z")
Hi, I need help in a use case. I am developing two custom plugins (say P1 & P2) . And I want to embed P2 into P1. (May be multiple plugins also). Can you please help me how to do this? --- ## [Document and field level security not supported in trial license](https://discuss.elastic.co/t/document-and-field-level-security-not-supported-in-trial-license/275248)
**Author:** [@boskjoett](https://discuss.elastic.co/u/boskjoett)\ **Replies:** 7\ **Last updated:** [June 9, 2021, 6:58am UTC](https://discuss.elastic.co/t/document-and-field-level-security-not-supported-in-trial-license/275248 "2021-06-09T06:58:57Z")
I have just made a trial installation of the Elastic Cloud to test out document level security. But when I configure document level security via the Elasticsearch API I get an error message saying that "Document and fiel… --- ## [Problems in Elasticsearch combining two types of logs using two pipelines (Logstash)](https://discuss.elastic.co/t/problems-in-elasticsearch-combining-two-types-of-logs-using-two-pipelines-logstash/273900)
**Author:** [@francesco96](https://discuss.elastic.co/u/francesco96)\ **Replies:** 1\ **Last updated:** [June 9, 2021, 6:51am UTC](https://discuss.elastic.co/t/problems-in-elasticsearch-combining-two-types-of-logs-using-two-pipelines-logstash/273900 "2021-06-09T06:51:43Z")
Hi everyone, I need some help. I have configured my ES stack inside a docker. I need to show two types of logs (syslog, log), in an Elastic index. I have created two configuration files logstash.cong logstash-syslog.c… --- ## [Failed to connect AWS ES cluster](https://discuss.elastic.co/t/failed-to-connect-aws-es-cluster/275314)
**Author:** [@richzw](https://discuss.elastic.co/u/richzw)\ **Replies:** 3\ **Last updated:** [June 9, 2021, 6:13am UTC](https://discuss.elastic.co/t/failed-to-connect-aws-es-cluster/275314 "2021-06-09T06:13:58Z")
Hi We try to connect to AWS ES through file beat, However, the following errors comes up pipeline/output.go:100 Failed to connect to backoff(elasticsearch(https://xxx.us-east-1.es.amazonaws.com:443)): Connection marke… --- ## [Logstash elasticsearch output, expand variables in data stream parameters](https://discuss.elastic.co/t/logstash-elasticsearch-output-expand-variables-in-data-stream-parameters/275276)
**Author:** [@ebourlon](https://discuss.elastic.co/u/ebourlon)\ **Replies:** 2\ **Last updated:** [June 9, 2021, 6:13am UTC](https://discuss.elastic.co/t/logstash-elasticsearch-output-expand-variables-in-data-stream-parameters/275276 "2021-06-09T06:13:01Z")
Hello, I am using logstash 7.13.1 that has support for datastreams in the elasticsearch output. As far as I looked at it is not possible to specify a variable in one of the datastream related parameter like below: e… --- ## [Top 10 in bar graph in kibana](https://discuss.elastic.co/t/top-10-in-bar-graph-in-kibana/275301)
**Author:** [@abhishek30](https://discuss.elastic.co/u/abhishek30)\ **Replies:** 2\ **Last updated:** [June 9, 2021, 6:11am UTC](https://discuss.elastic.co/t/top-10-in-bar-graph-in-kibana/275301 "2021-06-09T06:11:10Z")
Hi, I have a small setup of elk stack of 7.12.1. I have ingested some data related to candidate examination. I wanted to show top 10 questions for which candidate answered correct. This is shown as such in tag cloud. … --- ## [ILM action status - Waiting for all shard copies to be active](https://discuss.elastic.co/t/ilm-action-status-waiting-for-all-shard-copies-to-be-active/274209)
**Author:** [@braham](https://discuss.elastic.co/u/braham)\ **Replies:** 8\ **Last updated:** [June 9, 2021, 5:27am UTC](https://discuss.elastic.co/t/ilm-action-status-waiting-for-all-shard-copies-to-be-active/274209 "2021-06-09T05:27:19Z")
Hello, We have configured ILM policy but it's changing the phase "hot" to "warm" but after that not changing further phases like "cold" and "delete". We see action status "Waiting for all shard copies to be active". I… --- ## [How to give cluster IP in fluentd/kibana for 3 node Elasticsearch cluster](https://discuss.elastic.co/t/how-to-give-cluster-ip-in-fluentd-kibana-for-3-node-elasticsearch-cluster/275289)
**Author:** [@khgupta3](https://discuss.elastic.co/u/khgupta3)\ **Replies:** 5\ **Last updated:** [June 9, 2021, 5:13am UTC](https://discuss.elastic.co/t/how-to-give-cluster-ip-in-fluentd-kibana-for-3-node-elasticsearch-cluster/275289 "2021-06-09T05:13:13Z")
Hi All, I have 3 node cluster (3 VM with different IPs) . After going thru some documentations and other community questions, I read that in small cluster like if 3, to have redundancy it is good to make all Master as w… --- ## [Send the Ruby Exception message along with the \_rubyException tag](https://discuss.elastic.co/t/send-the-ruby-exception-message-along-with-the-rubyexception-tag/275369)
**Author:** [@mastersmit](https://discuss.elastic.co/u/mastersmit)\ **Replies:** 0\ **Last updated:** [June 9, 2021, 4:40am UTC](https://discuss.elastic.co/t/send-the-ruby-exception-message-along-with-the-rubyexception-tag/275369 "2021-06-09T04:40:25Z")
I have ruby filter processing and for some inputs, I do have ruby-exceptions and they are successfully propogated to elastic search with the tag. (expected). However I do not know why this exceptions are caused i.e the s… --- ## [Kibana url redirecting to /space/enter and giving 503 error when deployed on Kubernetes cluster](https://discuss.elastic.co/t/kibana-url-redirecting-to-space-enter-and-giving-503-error-when-deployed-on-kubernetes-cluster/275257)
**Author:** [@Shubham\_Dhote](https://discuss.elastic.co/u/Shubham_Dhote)\ **Replies:** 2\ **Last updated:** [June 9, 2021, 3:57am UTC](https://discuss.elastic.co/t/kibana-url-redirecting-to-space-enter-and-giving-503-error-when-deployed-on-kubernetes-cluster/275257 "2021-06-09T03:57:17Z")
I have deployed Kibana and elasticsearch pods in Kubernetes cluster, I have created ingress path url for both of them. Elasticsearch is accessible with ingress path url, but when trying to access kibana ui with ingress u… --- ## [Can not go get beats module](https://discuss.elastic.co/t/can-not-go-get-beats-module/275367)
**Author:** [@Montana\_Jony](https://discuss.elastic.co/u/Montana_Jony)\ **Replies:** 0\ **Last updated:** [June 9, 2021, 3:44am UTC](https://discuss.elastic.co/t/can-not-go-get-beats-module/275367 "2021-06-09T03:44:49Z")
ISSUE \[Elastic-Agent\] Can't go get module · Issue #26200 · elastic/beats · GitHub This is because of wrong file name with double dot --- ## [Create event on change of field](https://discuss.elastic.co/t/create-event-on-change-of-field/275363)
**Author:** [@johnwood](https://discuss.elastic.co/u/johnwood)\ **Replies:** 1\ **Last updated:** [June 9, 2021, 3:31am UTC](https://discuss.elastic.co/t/create-event-on-change-of-field/275363 "2021-06-09T03:31:42Z")
Hi All I need some help getting started in the right direction with a logstash configuration please: We have log events coming into logstash right now. From each of the events we currently parse the name of a computer … --- ## [Behaviour of searchable snapshot](https://discuss.elastic.co/t/behaviour-of-searchable-snapshot/275364)
**Author:** [@pk.241011](https://discuss.elastic.co/u/pk.241011)\ **Replies:** 0\ **Last updated:** [June 9, 2021, 3:25am UTC](https://discuss.elastic.co/t/behaviour-of-searchable-snapshot/275364 "2021-06-09T03:25:21Z")
Hi, I configured a index lifecycle policy. And at the end of the hot phase I configured a Searchable snapshot backed on a repository hosted on our S3 bucket. I have chosen the convert to fully mounted index option. T… --- ## [Losing logs in ELK](https://discuss.elastic.co/t/losing-logs-in-elk/275356)
**Author:** [@devopscanada](https://discuss.elastic.co/u/devopscanada)\ **Replies:** 2\ **Last updated:** [June 9, 2021, 2:08am UTC](https://discuss.elastic.co/t/losing-logs-in-elk/275356 "2021-06-09T02:08:24Z")
Setup: Kubernetes cluster with filebeat-7.12.0 -\> logstash-7.9. -\> elasticsearch-7.9.1 -\> kibana-7.9.1 Problem: we lose many logs often and sometimes in a massive way, as in we stop seeing logs from one or more pods… --- ## [Auto Delete old indices based on size (on hitting the low watermark setting)](https://discuss.elastic.co/t/auto-delete-old-indices-based-on-size-on-hitting-the-low-watermark-setting/275353)
**Author:** [@rakeshr](https://discuss.elastic.co/u/rakeshr)\ **Replies:** 2\ **Last updated:** [June 9, 2021, 2:04am UTC](https://discuss.elastic.co/t/auto-delete-old-indices-based-on-size-on-hitting-the-low-watermark-setting/275353 "2021-06-09T02:04:46Z")
Hi, Is there any setting which would auto Delete old indices on hitting the lower watermark setting? I could not find much information from the documentation regarding such a setting. If not, how can this be done ? --- ## [Kibana build error](https://discuss.elastic.co/t/kibana-build-error/275261)
**Author:** [@541002492](https://discuss.elastic.co/u/541002492)\ **Replies:** 3\ **Last updated:** [June 9, 2021, 1:36am UTC](https://discuss.elastic.co/t/kibana-build-error/275261 "2021-06-09T01:36:36Z")
info \[ kibana \] Copying source into platform-generic build directory │ERROR failure 13 sec │ERROR Error: EINVAL: invalid argument, utime 'D:\\Desktop\\kibana\\kibana\\kibana-7.10.0.0\\build\\kibana\\yarn.lock' My operating… --- ## [Filebeat messages dropped until 1PM in china zone](https://discuss.elastic.co/t/filebeat-messages-dropped-until-1pm-in-china-zone/274759)
**Author:** [@boba](https://discuss.elastic.co/u/boba)\ **Replies:** 1\ **Last updated:** [June 9, 2021, 12:53am UTC](https://discuss.elastic.co/t/filebeat-messages-dropped-until-1pm-in-china-zone/274759 "2021-06-09T00:53:46Z")
Hello, Messages before 1PM (5AM UTC) china time never appeared in graylog. New messages start piping at 1:00PM. All messages before 1:00 never arrived. I have light setup: linux, filebeat, sidecar, graylog, with just 2… --- ## [Is moving kibana indices to hot node ok?](https://discuss.elastic.co/t/is-moving-kibana-indices-to-hot-node-ok/275305)
**Author:** [@roh](https://discuss.elastic.co/u/roh)\ **Replies:** 1\ **Last updated:** [June 9, 2021, 12:31am UTC](https://discuss.elastic.co/t/is-moving-kibana-indices-to-hot-node-ok/275305 "2021-06-09T00:31:09Z")
Hi all My team is using hot to cold tier architecture for recent projects. There was an interesting opinion about kibana internal system indices. One of my teammates thought that if kibana indices are moved to cold tie… --- ## [Kibana: alert with various fields](https://discuss.elastic.co/t/kibana-alert-with-various-fields/273809)
**Author:** [@Guillermo\_Valles\_Cas](https://discuss.elastic.co/u/Guillermo_Valles_Cas)\ **Replies:** 3\ **Last updated:** [June 9, 2021, 12:03am UTC](https://discuss.elastic.co/t/kibana-alert-with-various-fields/273809 "2021-06-09T00:03:41Z")
This is my scenario: I have two fields (A and B) and I would like to create an alert where if sum(A+B) \> 90% (or A / B \> 1) should trigger the alert. It is possible to do that with alerts with Kibana? --- ## [Error in Vega visual Kibana](https://discuss.elastic.co/t/error-in-vega-visual-kibana/274592)
**Author:** [@Nisha2297](https://discuss.elastic.co/u/Nisha2297)\ **Replies:** 1\ **Last updated:** [June 8, 2021, 10:43pm UTC](https://discuss.elastic.co/t/error-in-vega-visual-kibana/274592 "2021-06-08T22:43:28Z")
Does anybody has any idea of "EsError" in Vega custom visualization in Kibana? What kind of elasticsearch error is this. I'm stuck with this error. Please help me resolving this issue! --- ## [Dashboard deployment process](https://discuss.elastic.co/t/dashboard-deployment-process/274926)
**Author:** [@ITchandj](https://discuss.elastic.co/u/ITchandj)\ **Replies:** 1\ **Last updated:** [June 8, 2021, 10:41pm UTC](https://discuss.elastic.co/t/dashboard-deployment-process/274926 "2021-06-08T22:41:47Z")
Hello!!! please how i can define kibana dashboard deployment process? thank for suggestion in advance. --- ## [Cannot login to Kibana since few days](https://discuss.elastic.co/t/cannot-login-to-kibana-since-few-days/274753)
**Author:** [@Valentin\_Magnan](https://discuss.elastic.co/u/Valentin_Magnan)\ **Replies:** 1\ **Last updated:** [June 8, 2021, 10:18pm UTC](https://discuss.elastic.co/t/cannot-login-to-kibana-since-few-days/274753 "2021-06-08T22:18:48Z")
Dear community, Since few days I cannot login to kibana anymore (through any users including elastic). Here are the Kibana's logs when I try to login: shwr - kibana | { "type": "log", "@timestamp": "2021-06-02… --- ## [Copy/Rename multiple field in the same field + adding multiples field to one field](https://discuss.elastic.co/t/copy-rename-multiple-field-in-the-same-field-adding-multiples-field-to-one-field/275264)
**Author:** [@frank\_rib](https://discuss.elastic.co/u/frank_rib)\ **Replies:** 4\ **Last updated:** [June 8, 2021, 10:07pm UTC](https://discuss.elastic.co/t/copy-rename-multiple-field-in-the-same-field-adding-multiples-field-to-one-field/275264 "2021-06-08T22:07:43Z")
Hello every body, I have two question about the mutate filter: The first one is about adding a0,a1 and a2 fiels that contain the process args to a same field \[process\]\[args\] (process.args=a0,a1,a2) how i can do it ? … --- ## [Search documents by unmapped fields for debugging](https://discuss.elastic.co/t/search-documents-by-unmapped-fields-for-debugging/275055)
**Author:** [@Metheny](https://discuss.elastic.co/u/Metheny)\ **Replies:** 3\ **Last updated:** [June 8, 2021, 10:07pm UTC](https://discuss.elastic.co/t/search-documents-by-unmapped-fields-for-debugging/275055 "2021-06-08T22:07:29Z")
We are using fixed (non dynamic) mapping in our indices in order to improve performance. The mapping contains a subset of our document fields, and the rest of the fields are unmapped. However, for debugging purposes we… --- ## [Kibana, missing fields](https://discuss.elastic.co/t/kibana-missing-fields/274989)
**Author:** [@Weathmious](https://discuss.elastic.co/u/Weathmious)\ **Replies:** 2\ **Last updated:** [June 8, 2021, 9:37pm UTC](https://discuss.elastic.co/t/kibana-missing-fields/274989 "2021-06-08T21:37:10Z")
Hello, I currently use graylog as SIEM. I kibana to install on the same server in order to better visualize the data. I created different extractors on graylog to have several fields extracted from the message: The p… --- ## [Metricbeat: configure (or reset) host.id](https://discuss.elastic.co/t/metricbeat-configure-or-reset-host-id/274925)
**Author:** [@BradVido](https://discuss.elastic.co/u/BradVido)\ **Replies:** 3\ **Last updated:** [June 8, 2021, 9:34pm UTC](https://discuss.elastic.co/t/metricbeat-configure-or-reset-host-id/274925 "2021-06-08T21:34:47Z")
We are using metricbeat to monitor logstash. We have many logstash vm's that are sending the same host.id in their metricbeat data. I'm guessing this is related to the vm's being cloned from the same template. How can … --- ## [Using \_metadata from .net app in discover](https://discuss.elastic.co/t/using-metadata-from-net-app-in-discover/275131)
**Author:** [@madlopt](https://discuss.elastic.co/u/madlopt)\ **Replies:** 2\ **Last updated:** [June 8, 2021, 9:21pm UTC](https://discuss.elastic.co/t/using-metadata-from-net-app-in-discover/275131 "2021-06-08T21:21:44Z")
Hi. I have .net apps with serilog. Serilog is configured from this doc. I am using FileBeat to send log to elasticsearch. I see \_metada.trace\_id and others \_metatda.\* fields in Kibana -\> Logs and can filter by them in L… --- ## [Unable to find valid certification path to requested target](https://discuss.elastic.co/t/unable-to-find-valid-certification-path-to-requested-target/274946)
**Author:** [@mstrbgn](https://discuss.elastic.co/u/mstrbgn)\ **Replies:** 1\ **Last updated:** [June 8, 2021, 9:17pm UTC](https://discuss.elastic.co/t/unable-to-find-valid-certification-path-to-requested-target/274946 "2021-06-08T21:17:12Z")
I face this issue while send mail using watcher Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target at sun.security.provider.certpat… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1375) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1377)