# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1422 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1423 --- ## [Unable to update index rollover](https://discuss.elastic.co/t/unable-to-update-index-rollover/272595)
**Author:** [@Jose\_Angel\_Morena\_Si](https://discuss.elastic.co/u/Jose_Angel_Morena_Si)\ **Replies:** 1\ **Last updated:** [May 10, 2021, 5:04pm UTC](https://discuss.elastic.co/t/unable-to-update-index-rollover/272595 "2021-05-10T17:04:17Z")
Hello there, I am trying to modify the rollover conditions of a handful of indexes in my ES cluster. Elasticsearch version: 7.11.2 Winlogbeat version: 7.11.2 In order to do so I am using the following query: curl -u… --- ## [Configuring analyser for field inside filbeat configuration file](https://discuss.elastic.co/t/configuring-analyser-for-field-inside-filbeat-configuration-file/270232)
**Author:** [@bbtl](https://discuss.elastic.co/u/bbtl)\ **Replies:** 1\ **Last updated:** [May 10, 2021, 4:44pm UTC](https://discuss.elastic.co/t/configuring-analyser-for-field-inside-filbeat-configuration-file/270232 "2021-05-10T16:44:13Z")
Hi I am currently using filbeat to send logs to ELK stack. However, one of the fields has a syslog structure and I would like to force filbeat to use a whitespace analyser and I would also like to have the .raw version … --- ## [Why sometime 99.99th doesn't shown](https://discuss.elastic.co/t/why-sometime-99-99th-doesnt-shown/272467)
**Author:** [@GITnewfish](https://discuss.elastic.co/u/GITnewfish)\ **Replies:** 1\ **Last updated:** [May 10, 2021, 4:32pm UTC](https://discuss.elastic.co/t/why-sometime-99-99th-doesnt-shown/272467 "2021-05-10T16:32:05Z")
I do found sometime 99.99th doesn't shown in my summary, and sometime it shows ok. In the doc, it said "Rally will not show a 99.99th percentile if it could only capture five samples because that would be a vanity metri… --- ## [Logstash no processing all my logs from Filebeat](https://discuss.elastic.co/t/logstash-no-processing-all-my-logs-from-filebeat/272593)
**Author:** [@calanon](https://discuss.elastic.co/u/calanon)\ **Replies:** 1\ **Last updated:** [May 10, 2021, 4:05pm UTC](https://discuss.elastic.co/t/logstash-no-processing-all-my-logs-from-filebeat/272593 "2021-05-10T16:05:20Z")
I have Filebeat transporting my logs to logstash and then to ES. The behaviour I have noticed is that some of my logs are processed and available in Kibana by not all. I see all the logs in the logstash debug log with … --- ## [Static lookup empty field value not showing in Kibana](https://discuss.elastic.co/t/static-lookup-empty-field-value-not-showing-in-kibana/272428)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 2\ **Last updated:** [May 10, 2021, 3:16pm UTC](https://discuss.elastic.co/t/static-lookup-empty-field-value-not-showing-in-kibana/272428 "2021-05-10T15:16:06Z")
Hi all, I'm using Currency field with option of Static lookup to change values . But I'm not able to change values for empty field values. Below screenshot. Empty fields are not showing unknown. Still they are emp… --- ## [Okta Module drops a lot of debugContext information from events](https://discuss.elastic.co/t/okta-module-drops-a-lot-of-debugcontext-information-from-events/272588)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 1\ **Last updated:** [May 10, 2021, 2:18pm UTC](https://discuss.elastic.co/t/okta-module-drops-a-lot-of-debugcontext-information-from-events/272588 "2021-05-10T14:18:41Z")
I recently noticed that the Okta module (mainly the Elastic pipeline) drops a good amount of data from the debugData field when moving it from json.debugContext to okta.debug\_context, and was wondering if this is intende… --- ## [Upgrade Agents Offline](https://discuss.elastic.co/t/upgrade-agents-offline/272585)
**Author:** [@scottdfedorov](https://discuss.elastic.co/u/scottdfedorov)\ **Replies:** 1\ **Last updated:** [May 10, 2021, 2:05pm UTC](https://discuss.elastic.co/t/upgrade-agents-offline/272585 "2021-05-10T14:05:44Z")
The docs are clear that Fleet: Requires internet access for Kibana to download integration packages and No proxy support in Elastic Agent However, it appears that each Agent also requires internet access in order… --- ## [Kibana increasing memory usage](https://discuss.elastic.co/t/kibana-increasing-memory-usage/272171)
**Author:** [@radovan](https://discuss.elastic.co/u/radovan)\ **Replies:** 4\ **Last updated:** [May 10, 2021, 2:03pm UTC](https://discuss.elastic.co/t/kibana-increasing-memory-usage/272171 "2021-05-10T14:03:05Z")
Hi, after upgrading to 7.12.0 a strange problem started occuring. Kibana keeps consuming more and more RAM until it goes to swap and then I have to restart kibana service because the performance goes wildly off. We have… --- ## [API key and document-level security: Query not limiting response](https://discuss.elastic.co/t/api-key-and-document-level-security-query-not-limiting-response/271786)
**Author:** [@sgasse](https://discuss.elastic.co/u/sgasse)\ **Replies:** 5\ **Last updated:** [May 10, 2021, 1:54pm UTC](https://discuss.elastic.co/t/api-key-and-document-level-security-query-not-limiting-response/271786 "2021-05-10T13:54:25Z")
Hi! I was reading up a bit on API keys and document level security. Here are the relevant guides that I read: Create an API key Document Level Secuity Now I created an API key like this: POST /\_security/api\_key { … --- ## [Grok works in debugger but not in Logstash](https://discuss.elastic.co/t/grok-works-in-debugger-but-not-in-logstash/272509)
**Author:** [@therealjack404](https://discuss.elastic.co/u/therealjack404)\ **Replies:** 3\ **Last updated:** [May 10, 2021, 1:41pm UTC](https://discuss.elastic.co/t/grok-works-in-debugger-but-not-in-logstash/272509 "2021-05-10T13:41:39Z")
Hi. I am struggling to write a grok pattern for Modsecurity Logs from the apache error log. I have included a sample log and the grok pattern. I isolated the timestamp creation which works on its own. However the rest wo… --- ## [Index not rollover when the date changes](https://discuss.elastic.co/t/index-not-rollover-when-the-date-changes/272385)
**Author:** [@maadhav](https://discuss.elastic.co/u/maadhav)\ **Replies:** 4\ **Last updated:** [May 10, 2021, 1:37pm UTC](https://discuss.elastic.co/t/index-not-rollover-when-the-date-changes/272385 "2021-05-10T13:37:33Z")
Hi Team With ILM policy, we can do rollover using different parameters such as size/document\_count/age. This works fine and if we create first index with date-math, we are able to generate date-wise index. But the prob… --- ## [Kibana Sorting out Array values](https://discuss.elastic.co/t/kibana-sorting-out-array-values/272266)
**Author:** [@kanikasingla](https://discuss.elastic.co/u/kanikasingla)\ **Replies:** 4\ **Last updated:** [May 10, 2021, 1:35pm UTC](https://discuss.elastic.co/t/kibana-sorting-out-array-values/272266 "2021-05-10T13:35:13Z")
Hi Team, I am working with Elastic FunctionBeat to send logs from AWS CloudWatch Logs. I am able to create data tables, graphs etc. There is one issue when I am trying to show field which is nested array (nestedResults… --- ## [Dashboard or Canvas with a drop down for filters for a data table](https://discuss.elastic.co/t/dashboard-or-canvas-with-a-drop-down-for-filters-for-a-data-table/272310)
**Author:** [@chapmantrain](https://discuss.elastic.co/u/chapmantrain)\ **Replies:** 4\ **Last updated:** [May 10, 2021, 1:32pm UTC](https://discuss.elastic.co/t/dashboard-or-canvas-with-a-drop-down-for-filters-for-a-data-table/272310 "2021-05-10T13:32:43Z")
I have some network utilization data that I need to filter by all hours, prime business hours, non business hours. The filters are not straight forward as I'm dealing with local times across time zones. The prime filter … --- ## [Error calling pipeline when setting the document ID in beats](https://discuss.elastic.co/t/error-calling-pipeline-when-setting-the-document-id-in-beats/272560)
**Author:** [@Francisco\_Peralta\_Gu](https://discuss.elastic.co/u/Francisco_Peralta_Gu)\ **Replies:** 6\ **Last updated:** [May 10, 2021, 1:30pm UTC](https://discuss.elastic.co/t/error-calling-pipeline-when-setting-the-document-id-in-beats/272560 "2021-05-10T13:30:29Z")
Hi. I'm facing issues when I try to set the document id in filebeat to avoid duplicates: I have a filebeat configuration as following: filebeat.inputs: - type: log paths: - /dumps-json/wsdumps/\*\* … --- ## [ILM phases rolling out index but keeping](https://discuss.elastic.co/t/ilm-phases-rolling-out-index-but-keeping/272291)
**Author:** [@narendraingale2](https://discuss.elastic.co/u/narendraingale2)\ **Replies:** 2\ **Last updated:** [May 10, 2021, 1:27pm UTC](https://discuss.elastic.co/t/ilm-phases-rolling-out-index-but-keeping/272291 "2021-05-10T13:27:21Z")
Hi All Below is my ILM policy { "policy": { "phases": { "hot": { "min\_age": "0ms", "actions": { "rollover": { "max\_size": "200gb", "max\_age": "7d" … --- ## [Elastic shards and replica](https://discuss.elastic.co/t/elastic-shards-and-replica/272552)
**Author:** [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\ **Replies:** 5\ **Last updated:** [May 10, 2021, 1:21pm UTC](https://discuss.elastic.co/t/elastic-shards-and-replica/272552 "2021-05-10T13:21:43Z")
Hello everyone, I would like to understand something about shards and replica, I have a cluster of 3 DATA nodes (2 Hot and 1 Warm), I have configured ILM to have one shard and one replica in the HOT nodes, and then onc… --- ## [Self hosted in aws ec2](https://discuss.elastic.co/t/self-hosted-in-aws-ec2/272483)
**Author:** [@THOM-AwS](https://discuss.elastic.co/u/THOM-AwS)\ **Replies:** 5\ **Last updated:** [May 10, 2021, 1:13pm UTC](https://discuss.elastic.co/t/self-hosted-in-aws-ec2/272483 "2021-05-10T13:13:27Z")
Hey all, this is part question, and part tips for my elastic experience on ec2. for background I am running two servers, one with elasticsearch on an m6gd.large, and the other server runs kibana on an m6gd.medium. this i… --- ## [I need pass one kibana nginx header name(testHeader1) to elasticsearch proxy. Now i use requestHeadersWhitelist which including "testHeader1" ,but it does not word](https://discuss.elastic.co/t/i-need-pass-one-kibana-nginx-header-name-testheader1-to-elasticsearch-proxy-now-i-use-requestheaderswhitelist-which-including-testheader1-but-it-does-not-word/272374)
**Author:** [@linger000](https://discuss.elastic.co/u/linger000)\ **Replies:** 1\ **Last updated:** [May 10, 2021, 12:07pm UTC](https://discuss.elastic.co/t/i-need-pass-one-kibana-nginx-header-name-testheader1-to-elasticsearch-proxy-now-i-use-requestheaderswhitelist-which-including-testheader1-but-it-does-not-word/272374 "2021-05-10T12:07:27Z")
i need pass one kibana nginx header name(testHeader1) to elasticsearch proxy. Now i use requestHeadersWhitelist which including "testHeader1" ,but it does not word. kibana version:6.8.0 --- ## [Find and replace word in all documents in any field](https://discuss.elastic.co/t/find-and-replace-word-in-all-documents-in-any-field/272393)
**Author:** [@simone.dicola](https://discuss.elastic.co/u/simone.dicola)\ **Replies:** 4\ **Last updated:** [May 10, 2021, 11:52am UTC](https://discuss.elastic.co/t/find-and-replace-word-in-all-documents-in-any-field/272393 "2021-05-10T11:52:12Z")
As per title, due to a bug in conversion library, we got more than 200k documents containing & instead of &. Is there a query I can run to do a find and replace in any field? Thanks --- ## [Filebeat slowness issue due to Continuously keeping 200+ open files](https://discuss.elastic.co/t/filebeat-slowness-issue-due-to-continuously-keeping-200-open-files/271876)
**Author:** [@rohitguptaggg](https://discuss.elastic.co/u/rohitguptaggg)\ **Replies:** 9\ **Last updated:** [May 10, 2021, 11:45am UTC](https://discuss.elastic.co/t/filebeat-slowness-issue-due-to-continuously-keeping-200-open-files/271876 "2021-05-10T11:45:05Z")
Hi team, Suffering with issue of filebeat (version 7.0.1) slowness.Our application is generating logs in different file locations and after reaching the log file size to 2 gb, it is generating another new file after ren… --- ## [Metricbeat suddenly stops reporting](https://discuss.elastic.co/t/metricbeat-suddenly-stops-reporting/272563)
**Author:** [@gborg](https://discuss.elastic.co/u/gborg)\ **Replies:** 2\ **Last updated:** [May 10, 2021, 10:58am UTC](https://discuss.elastic.co/t/metricbeat-suddenly-stops-reporting/272563 "2021-05-10T10:58:19Z")
I have a weird situation going on I have a group of windows servers, all running metricbeat (7.10.0) and using the IIS module to monitor IIS statistics. They all send to a central redis that collects the data, which th… --- ## [Reindex remote-Received Error "socket\_exception" & "Connection reset"](https://discuss.elastic.co/t/reindex-remote-received-error-socket-exception-connection-reset/272538)
**Author:** [@Ragul\_R](https://discuss.elastic.co/u/Ragul_R)\ **Replies:** 6\ **Last updated:** [May 10, 2021, 10:55am UTC](https://discuss.elastic.co/t/reindex-remote-received-error-socket-exception-connection-reset/272538 "2021-05-10T10:55:54Z")
I'm Copying index remotely cluster1 to Cluster2.\[Received Error "socket\_exception" & "Connection reset"\] i haved tried Type 1& 2 configuration, im facing same error elasticsearch.yml Type1: reindex.remote.whitelist:… --- ## [Logstash cannot find logstash.yml directory](https://discuss.elastic.co/t/logstash-cannot-find-logstash-yml-directory/272288)
**Author:** [@almotasim90](https://discuss.elastic.co/u/almotasim90)\ **Replies:** 4\ **Last updated:** [May 10, 2021, 10:53am UTC](https://discuss.elastic.co/t/logstash-cannot-find-logstash-yml-directory/272288 "2021-05-10T10:53:13Z")
Hi, I am running ELK stack in debian 10. I removed logstash with apt command and removed /etc/logstash , /var/lib/logstash directories. Now I am trying to install logstash again, but it does not install all confugrati… --- ## [https://artifacts.elastic.co/packages/7.x/apt/dists/stable/InRelease intermittently fails](https://discuss.elastic.co/t/https-artifacts-elastic-co-packages-7-x-apt-dists-stable-inrelease-intermittently-fails/272317)
**Author:** [@baba.tunde](https://discuss.elastic.co/u/baba.tunde)\ **Replies:** 2\ **Last updated:** [May 10, 2021, 10:49am UTC](https://discuss.elastic.co/t/https-artifacts-elastic-co-packages-7-x-apt-dists-stable-inrelease-intermittently-fails/272317 "2021-05-10T10:49:05Z")
Hi folks, ############################################### wget https://artifacts.elastic.co/packages/7.x/apt/dists/stable/InRelease --2021-05-06 17:35:16-- https://artifacts.elastic.co/packages/7.x/apt/dists/stable/I… --- ## [\_component\_template APT got error](https://discuss.elastic.co/t/component-template-apt-got-error/271731)
**Author:** [@carpeDiem](https://discuss.elastic.co/u/carpeDiem)\ **Replies:** 6\ **Last updated:** [May 10, 2021, 9:36am UTC](https://discuss.elastic.co/t/component-template-apt-got-error/271731 "2021-05-10T09:36:42Z")
Hello experts, We are doing features about data-stream,ilm....I use GET /\_component\_template/template\_1,template\_2API to get more templates for once,but I got an error: resource\_not\_found\_exception,I had see the guide,I… --- ## [Need help with watcher](https://discuss.elastic.co/t/need-help-with-watcher/271755)
**Author:** [@Tatamata](https://discuss.elastic.co/u/Tatamata)\ **Replies:** 1\ **Last updated:** [May 10, 2021, 9:31am UTC](https://discuss.elastic.co/t/need-help-with-watcher/271755 "2021-05-10T09:31:13Z")
I need some help with watcher below. It is working but in email that is send to me I receive 10 cases of connection that receive code 503. I’d like instead to get a total number of calls with 503 for each IP. For instanc… --- ## [Changed the field type after adding in elasticsearch](https://discuss.elastic.co/t/changed-the-field-type-after-adding-in-elasticsearch/272558)
**Author:** [@Dhiraj](https://discuss.elastic.co/u/Dhiraj)\ **Replies:** 2\ **Last updated:** [May 10, 2021, 9:30am UTC](https://discuss.elastic.co/t/changed-the-field-type-after-adding-in-elasticsearch/272558 "2021-05-10T09:30:46Z")
Hello, I have created one index. in which I send one field name as "elapsed\_time" as float. for that, I use logstash filter for converting data types. but it is added as a string into elasticsearch instead of float. I … --- ## [Redundant should block or query\_string in query?](https://discuss.elastic.co/t/redundant-should-block-or-query-string-in-query/270602)
**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Replies:** 2\ **Last updated:** [May 10, 2021, 9:27am UTC](https://discuss.elastic.co/t/redundant-should-block-or-query-string-in-query/270602 "2021-05-10T09:27:56Z")
hey there, I can get the same result using two different approach for a specific query. The first one uses several should terms "should": \[ { "terms": { "fieldname": \["valu… --- ## [Product title autocompletion/suggestions](https://discuss.elastic.co/t/product-title-autocompletion-suggestions/271949)
**Author:** [@corlee](https://discuss.elastic.co/u/corlee)\ **Replies:** 1\ **Last updated:** [May 10, 2021, 9:26am UTC](https://discuss.elastic.co/t/product-title-autocompletion-suggestions/271949 "2021-05-10T09:26:34Z")
Hi there, I'm currently struggling with autocompletion/suggestions. I've got a product database with a title, description, price, etc. What i want to achieve is for example: Example: When i search for "ipad", I want t… --- ## [Named Query Confusion](https://discuss.elastic.co/t/named-query-confusion/271997)
**Author:** [@bsmith](https://discuss.elastic.co/u/bsmith)\ **Replies:** 1\ **Last updated:** [May 10, 2021, 9:25am UTC](https://discuss.elastic.co/t/named-query-confusion/271997 "2021-05-10T09:25:37Z")
I understand that named queries add the matched\_queries property to the response, but is there any way to access documents that match the named queries in aggregations? The goal is to be able to use the "%dashboard\_cont… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1421) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1423)