# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1379 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1380 --- ## [How backup delete indices](https://discuss.elastic.co/t/how-backup-delete-indices/275080)
**Author:** [@Ilya\_21bA](https://discuss.elastic.co/u/Ilya_21bA)\ **Replies:** 17\ **Last updated:** [June 8, 2021, 12:59am UTC](https://discuss.elastic.co/t/how-backup-delete-indices/275080 "2021-06-08T00:59:06Z")
Hi! System indexes were accidentally deleted, name: .kibana, .kibana\_1, .kibana\_task\_manager, .security, .security-7 Log text on Elasticsearch: \[2021-06-02T17:44:32,369\]\[DEBUG\]\[o.e.a.s.TransportSearchAction\] \[AGILEVLG… --- ## [Connect to Eleasticsearch with Vscode](https://discuss.elastic.co/t/connect-to-eleasticsearch-with-vscode/275215)
**Author:** [@s-ho](https://discuss.elastic.co/u/s-ho)\ **Replies:** 0\ **Last updated:** [June 8, 2021, 12:30am UTC](https://discuss.elastic.co/t/connect-to-eleasticsearch-with-vscode/275215 "2021-06-08T00:30:28Z")
Does anyone try to connect to the elastic cloud using the "elastic search for VScode" plugin? or Do you use other IDEs connect to the elastic cloud? Just wish to do all the coding on my preferable interface. Thx --- ## [Fanotify vs inotify](https://discuss.elastic.co/t/fanotify-vs-inotify/275213)
**Author:** [@nwed](https://discuss.elastic.co/u/nwed)\ **Replies:** 0\ **Last updated:** [June 8, 2021, 12:15am UTC](https://discuss.elastic.co/t/fanotify-vs-inotify/275213 "2021-06-08T00:15:56Z")
Hello, on kube we currently leverage two iterations of the file\_integrity module. First, we monitor paths under /hostfs, this has been stable for us. Second, we use the auditbeat.autodiscover with containerd to monitor c… --- ## [Scripted fields values not getting populated on visualize but are populated during discover](https://discuss.elastic.co/t/scripted-fields-values-not-getting-populated-on-visualize-but-are-populated-during-discover/274931)
**Author:** [@nitish012](https://discuss.elastic.co/u/nitish012)\ **Replies:** 10\ **Last updated:** [June 7, 2021, 11:48pm UTC](https://discuss.elastic.co/t/scripted-fields-values-not-getting-populated-on-visualize-but-are-populated-during-discover/274931 "2021-06-07T23:48:00Z")
Hi Kibana Experts, I am using Kibana scripted fields using painless to populate a URL like this: Url Template : https://dummy\_url?branch={{value}}&id=abc Script: if (!doc\['branch\_name'\].empty) { return (doc\['branc… --- ## [Updating index with new field, based on the values of existing fields](https://discuss.elastic.co/t/updating-index-with-new-field-based-on-the-values-of-existing-fields/275144)
**Author:** [@saif3r](https://discuss.elastic.co/u/saif3r)\ **Replies:** 1\ **Last updated:** [June 7, 2021, 11:44pm UTC](https://discuss.elastic.co/t/updating-index-with-new-field-based-on-the-values-of-existing-fields/275144 "2021-06-07T23:44:50Z")
Hello, I have an index with two fields: City\_1 and City\_2. I would like to create a new field and update all existing documents based on the outcome of the following logical test: If City\_1 = City\_2 Then Match Else No … --- ## [Index lifecycle error - index.lifecycle.rollover\_alias syntax](https://discuss.elastic.co/t/index-lifecycle-error-index-lifecycle-rollover-alias-syntax/274933)
**Author:** [@AClerk](https://discuss.elastic.co/u/AClerk)\ **Replies:** 4\ **Last updated:** [June 7, 2021, 11:30pm UTC](https://discuss.elastic.co/t/index-lifecycle-error-index-lifecycle-rollover-alias-syntax/274933 "2021-06-07T23:30:19Z")
Hey All, Can someone help me with the syntax required? Or maybe I am missing something else? I got this error on the indices. This is my ILM policy below. How should I add the alias part? PUT \_ilm/policy/ilm-36-h… --- ## [Heartbeat Maximum No. of Monitors](https://discuss.elastic.co/t/heartbeat-maximum-no-of-monitors/274206)
**Author:** [@inhinyera16](https://discuss.elastic.co/u/inhinyera16)\ **Replies:** 1\ **Last updated:** [June 7, 2021, 11:09pm UTC](https://discuss.elastic.co/t/heartbeat-maximum-no-of-monitors/274206 "2021-06-07T23:09:21Z")
Saw this thread way back 4 years ago but it seems like there's no update or similar thread regarding this. We wanted to monitor millions of websites/services atleast once a day. We can run a job that can configure the … --- ## [Python bulk insert error](https://discuss.elastic.co/t/python-bulk-insert-error/275044)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 1\ **Last updated:** [June 7, 2021, 9:33pm UTC](https://discuss.elastic.co/t/python-bulk-insert-error/275044 "2021-06-07T21:33:28Z")
Using python code I am getting this error. if I use same code same data and just change index name it works. Is something wrong with existing index? how do I find this out? raise BulkIndexError("%i document(s) failed… --- ## [Recurring errors when backing up to GCS - FileAlreadyExistsException](https://discuss.elastic.co/t/recurring-errors-when-backing-up-to-gcs-filealreadyexistsexception/275205)
**Author:** [@hub](https://discuss.elastic.co/u/hub)\ **Replies:** 0\ **Last updated:** [June 7, 2021, 9:07pm UTC](https://discuss.elastic.co/t/recurring-errors-when-backing-up-to-gcs-filealreadyexistsexception/275205 "2021-06-07T21:07:18Z")
Hello, I have a recurring errors when Im doing snapshot to GCS bucket: {\\"type\\":\\"index\_shard\_snapshot\_failed\_exception\\",\\"reason\\":\\"IndexShardSnapshotFailedException\[Failed to perform snapshot (index files)\]; nested… --- ## [Elasticsearch error: Validation Failed: 1: parent histogram of moving\_avg aggregation \[3\] must have min\_doc\_count of 0;](https://discuss.elastic.co/t/elasticsearch-error-validation-failed-1-parent-histogram-of-moving-avg-aggregation-3-must-have-min-doc-count-of-0/274033)
**Author:** [@Isekai](https://discuss.elastic.co/u/Isekai)\ **Replies:** 2\ **Last updated:** [June 7, 2021, 8:54pm UTC](https://discuss.elastic.co/t/elasticsearch-error-validation-failed-1-parent-histogram-of-moving-avg-aggregation-3-must-have-min-doc-count-of-0/274033 "2021-06-07T20:54:24Z")
Greetings everyone Yesterday we updated elastic from 7.4.x to 7.10.1 and some of our grafana dashboards broke with the following error: Elasticsearch error: Validation Failed: 1: parent histogram of moving\_avg aggrega… --- ## [Total number of file descriptors in system](https://discuss.elastic.co/t/total-number-of-file-descriptors-in-system/275199)
**Author:** [@crash0er](https://discuss.elastic.co/u/crash0er)\ **Replies:** 0\ **Last updated:** [June 7, 2021, 8:27pm UTC](https://discuss.elastic.co/t/total-number-of-file-descriptors-in-system/275199 "2021-06-07T20:27:35Z")
Hello, How can I get total number of file descriptors in elastic metricbeat? I referred to this commit but this is only per process. Reference: System fields | Metricbeat Reference \[7.13\] | Elastic Is there a system.… --- ## [Could not execute action: PipelineAction::Create](https://discuss.elastic.co/t/could-not-execute-action-pipelineaction-create/275196)
**Author:** [@jeroen.antsec](https://discuss.elastic.co/u/jeroen.antsec)\ **Replies:** 0\ **Last updated:** [June 7, 2021, 8:02pm UTC](https://discuss.elastic.co/t/could-not-execute-action-pipelineaction-create/275196 "2021-06-07T20:02:26Z")
Hi guys, I have a question. I have a nice running logstash and elastic cluster. When i create a large pipeline of over 4000 lines logstash crashes with the following error: \[2021-06-07T19:27:23,511\]\[INFO \]\[logstash.jav… --- ## [Filebeat now reading the files with numbers](https://discuss.elastic.co/t/filebeat-now-reading-the-files-with-numbers/275195)
**Author:** [@shani\_angarkadu](https://discuss.elastic.co/u/shani_angarkadu)\ **Replies:** 0\ **Last updated:** [June 7, 2021, 7:57pm UTC](https://discuss.elastic.co/t/filebeat-now-reading-the-files-with-numbers/275195 "2021-06-07T19:57:36Z")
My log files are named with numbers for example 45678.rdlog and the filebeat couldn't able to read it and if I re name the file to something like test.rdlog it can able to read it. these logs are generated by rundeck an… --- ## [Create HTTPS Enabled Elasticsearch API](https://discuss.elastic.co/t/create-https-enabled-elasticsearch-api/274881)
**Author:** [@ankitdevnalkar](https://discuss.elastic.co/u/ankitdevnalkar)\ **Replies:** 3\ **Last updated:** [June 7, 2021, 7:51pm UTC](https://discuss.elastic.co/t/create-https-enabled-elasticsearch-api/274881 "2021-06-07T19:51:37Z")
While going through the document of creating an Elasticsearch API, there is a note for http.ssl.enabled node. It is asking to specify https while creating API key, but I am bit confused that where I need to mention about… --- ## [Metricbeat AWS credentials not working for Non-region endpoint](https://discuss.elastic.co/t/metricbeat-aws-credentials-not-working-for-non-region-endpoint/275191)
**Author:** [@swontonsoup](https://discuss.elastic.co/u/swontonsoup)\ **Replies:** 0\ **Last updated:** [June 7, 2021, 7:29pm UTC](https://discuss.elastic.co/t/metricbeat-aws-credentials-not-working-for-non-region-endpoint/275191 "2021-06-07T19:29:23Z")
This is similar to Metricbeat AWS module endpoint not working correctly. I tested on 7.13.1, but I think this should persist to current master branch. So I tried 3 different configurations and am unable to get the desir… --- ## [Having a hard time writing a query to exclude results](https://discuss.elastic.co/t/having-a-hard-time-writing-a-query-to-exclude-results/275186)
**Author:** [@ccvanilla](https://discuss.elastic.co/u/ccvanilla)\ **Replies:** 0\ **Last updated:** [June 7, 2021, 6:25pm UTC](https://discuss.elastic.co/t/having-a-hard-time-writing-a-query-to-exclude-results/275186 "2021-06-07T18:25:00Z")
Hello! I'm having a hard time writing a query to exclude certain results. I want to be able to search the index for one or many job titles, but also exclude one or many job titles from the results. For example, I want … --- ## [Winlogbeat drop\_fields not working](https://discuss.elastic.co/t/winlogbeat-drop-fields-not-working/275129)
**Author:** [@Billz1026](https://discuss.elastic.co/u/Billz1026)\ **Replies:** 5\ **Last updated:** [June 7, 2021, 6:20pm UTC](https://discuss.elastic.co/t/winlogbeat-drop-fields-not-working/275129 "2021-06-07T18:20:48Z")
Hi All, I have configured Winlogbeat to drop some fields from all the events using below configuration. But it seems the "drop\_fields" process is not applying to the events since I can see those fields in the Kibana. C… --- ## [Logstash stops getting events once in 3 days](https://discuss.elastic.co/t/logstash-stops-getting-events-once-in-3-days/274490)
**Author:** [@RAM\_NATHAN](https://discuss.elastic.co/u/RAM_NATHAN)\ **Replies:** 10\ **Last updated:** [June 7, 2021, 5:11pm UTC](https://discuss.elastic.co/t/logstash-stops-getting-events-once-in-3-days/274490 "2021-06-07T17:11:40Z")
We are using Logstash 7.4.2. Once in 3-4 days, Logstash stops processing events and its not parsing new events till we restart the service. We see only below error in log , :body=\>"{"error":{"root\_cause":\[{"type":"actio… --- ## [Sql Query to get data from more than one Indices](https://discuss.elastic.co/t/sql-query-to-get-data-from-more-than-one-indices/275147)
**Author:** [@Resington\_R](https://discuss.elastic.co/u/Resington_R)\ **Replies:** 5\ **Last updated:** [June 7, 2021, 5:03pm UTC](https://discuss.elastic.co/t/sql-query-to-get-data-from-more-than-one-indices/275147 "2021-06-07T17:03:54Z")
Hi... I am using the below query to get the data from 2 Indices, but I am getting this error "Queries with multiple indices are not supported". myindex1 and myindex2 structures are identical. I am using Elasticsearch V… --- ## [Filter aggregation buckets by top hits scripted field](https://discuss.elastic.co/t/filter-aggregation-buckets-by-top-hits-scripted-field/275181)
**Author:** [@mouse\_clicker](https://discuss.elastic.co/u/mouse_clicker)\ **Replies:** 0\ **Last updated:** [June 7, 2021, 5:03pm UTC](https://discuss.elastic.co/t/filter-aggregation-buckets-by-top-hits-scripted-field/275181 "2021-06-07T17:03:41Z")
Hello everyone. Let me start by explaining the end goal of the query I'm trying to build. We have a document with the following (relative to the question) mapping: { "analysis-results" : { "mappings" : { "pr… --- ## [Cannot get original timestamp from WSo2 logs coming from Source -\> filebeat -\> logstash -\> Elasticsearch](https://discuss.elastic.co/t/cannot-get-original-timestamp-from-wso2-logs-coming-from-source-filebeat-logstash-elasticsearch/275148)
**Author:** [@Jefledge](https://discuss.elastic.co/u/Jefledge)\ **Replies:** 1\ **Last updated:** [June 7, 2021, 4:59pm UTC](https://discuss.elastic.co/t/cannot-get-original-timestamp-from-wso2-logs-coming-from-source-filebeat-logstash-elasticsearch/275148 "2021-06-07T16:59:19Z")
I currently have logstash and filebeat running on the same AWS EC2 as a proof of concept to get logs from efs and push to Elastic for us to view on Kibana. It is all set up and working nicely, there is just one issue I c… --- ## [How Logstash works for 10,000 lines of log file](https://discuss.elastic.co/t/how-logstash-works-for-10-000-lines-of-log-file/275118)
**Author:** [@sudo-ranjith](https://discuss.elastic.co/u/sudo-ranjith)\ **Replies:** 3\ **Last updated:** [June 7, 2021, 4:58pm UTC](https://discuss.elastic.co/t/how-logstash-works-for-10-000-lines-of-log-file/275118 "2021-06-07T16:58:00Z")
I have log file that has 10,000 lines of logs, every hour 10 lines of logs will be added in the log file. at 3 AM I have 10,000 line of logs at 4 AM 10,010 lines of logs at 5 AM 10,020 lines of logs.... I would like … --- ## [Elastic App Search -- Importing Json files](https://discuss.elastic.co/t/elastic-app-search-importing-json-files/274992)
**Author:** [@NiklasSpira](https://discuss.elastic.co/u/NiklasSpira)\ **Replies:** 3\ **Last updated:** [June 7, 2021, 4:51pm UTC](https://discuss.elastic.co/t/elastic-app-search-importing-json-files/274992 "2021-06-07T16:51:35Z")
Hello Guys, I have a problem with importing Jsons into my Elastic App Search. I've gone through nearly all the existing threads, here and everywhere else but I couldn't get my problem fixed. I'm currently trying to imp… --- ## [Logstach output data to mongodb handshake error](https://discuss.elastic.co/t/logstach-output-data-to-mongodb-handshake-error/275099)
**Author:** [@zhidong\_yuan](https://discuss.elastic.co/u/zhidong_yuan)\ **Replies:** 1\ **Last updated:** [June 7, 2021, 4:35pm UTC](https://discuss.elastic.co/t/logstach-output-data-to-mongodb-handshake-error/275099 "2021-06-07T16:35:12Z")
I just output data to monodb with Mongodb output plugin(v3.1.6). However, somethong worng happens when logstash straring up . The logs like this: \[INFO \] 2021-06-07 13:20:09.220 \[\[main\]-pipeline-manager\] javapipeline… --- ## [Processor foreach field error hash map](https://discuss.elastic.co/t/processor-foreach-field-error-hash-map/274848)
**Author:** [@accateo](https://discuss.elastic.co/u/accateo)\ **Replies:** 6\ **Last updated:** [June 7, 2021, 4:02pm UTC](https://discuss.elastic.co/t/processor-foreach-field-error-hash-map/274848 "2021-06-07T16:02:26Z")
Hi, I have this processor: \[ { "foreach": { "field": "location", "processor": { "set": { "field": "geo.lat", "value": "{{\_ingest.\_value.lat}}" } } } }, … --- ## [Highest value possible for boosted fields](https://discuss.elastic.co/t/highest-value-possible-for-boosted-fields/275175)
**Author:** [@jlarroque](https://discuss.elastic.co/u/jlarroque)\ **Replies:** 0\ **Last updated:** [June 7, 2021, 3:49pm UTC](https://discuss.elastic.co/t/highest-value-possible-for-boosted-fields/275175 "2021-06-07T15:49:14Z")
Hi Elastic team, I would like to know what are the limits for boosting for boosted fields on a query, can I use 2000 ? Can I use 1M ? All examples I have seen are between 0 and 2, but I would like to know in advance what… --- ## [Kibana TSVB Metric -\> Delta between today and yesterday](https://discuss.elastic.co/t/kibana-tsvb-metric-delta-between-today-and-yesterday/274064)
**Author:** [@Lucas\_Erlacher](https://discuss.elastic.co/u/Lucas_Erlacher)\ **Replies:** 2\ **Last updated:** [June 7, 2021, 3:39pm UTC](https://discuss.elastic.co/t/kibana-tsvb-metric-delta-between-today-and-yesterday/274064 "2021-06-07T15:39:55Z")
Hello Community, I have the following metric showing today's & yesterday's avg. session duration. Is there a way to show the delta between the 2 metrics? Thanks a lot for your help. --- ## [\[filebeat azure module\] storage account permissions](https://discuss.elastic.co/t/filebeat-azure-module-storage-account-permissions/275172)
**Author:** [@daniele.saccon](https://discuss.elastic.co/u/daniele.saccon)\ **Replies:** 0\ **Last updated:** [June 7, 2021, 3:37pm UTC](https://discuss.elastic.co/t/filebeat-azure-module-storage-account-permissions/275172 "2021-06-07T15:37:25Z")
Hi everybody, the storage\_account used in the Azure module of Filebeat what permissions does require? Thanks Daniele --- ## [Vega Maps Zoom](https://discuss.elastic.co/t/vega-maps-zoom/275111)
**Author:** [@gerardo\_dutan](https://discuss.elastic.co/u/gerardo_dutan)\ **Replies:** 2\ **Last updated:** [June 7, 2021, 2:47pm UTC](https://discuss.elastic.co/t/vega-maps-zoom/275111 "2021-06-07T14:47:04Z")
I'm currently using vega maps to look at geo data and noticed that the zoom level for a vega map based visualization seems to lower than what is theoretically possible from the local map tile server that I'm using, curre… --- ## [Time\_zone parameter](https://discuss.elastic.co/t/time-zone-parameter/275161)
**Author:** [@qwerty123](https://discuss.elastic.co/u/qwerty123)\ **Replies:** 3\ **Last updated:** [June 7, 2021, 2:41pm UTC](https://discuss.elastic.co/t/time-zone-parameter/275161 "2021-06-07T14:41:34Z")
hi !! does elasticsearch range query always work based on UTC time zone ?? if so, is it possible to change this and make it work according to user required time zone ?? even when i use time\_zone parameter in my query, t… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1378) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1380)