# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1424 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1425 --- ## [Kibana failed to load policy issue](https://discuss.elastic.co/t/kibana-failed-to-load-policy-issue/272461)
**Author:** [@Mithoon](https://discuss.elastic.co/u/Mithoon)\ **Replies:** 1\ **Last updated:** [May 10, 2021, 12:28am UTC](https://discuss.elastic.co/t/kibana-failed-to-load-policy-issue/272461 "2021-05-10T00:28:10Z")
Currently using index state management created policy to delete indexes which are older than 5 days. Using templates applying policies to new index creations. The policy works well for few days and later old indexes stop… --- ## [Connecting Elasticsearch to Kibana](https://discuss.elastic.co/t/connecting-elasticsearch-to-kibana/272463)
**Author:** [@jie\_olaf](https://discuss.elastic.co/u/jie_olaf)\ **Replies:** 1\ **Last updated:** [May 10, 2021, 12:27am UTC](https://discuss.elastic.co/t/connecting-elasticsearch-to-kibana/272463 "2021-05-10T00:27:33Z")
I am trying to display the iris data in kibana by connecting to elasticsearch and creating an index called "iris" in R. I am taking the following steps: Execute elasticsearch 5.5.3 batch file (localhost:9200 displays re… --- ## [WinlogBeat - parsing "message" field](https://discuss.elastic.co/t/winlogbeat-parsing-message-field/272497)
**Author:** [@filip.wozniak](https://discuss.elastic.co/u/filip.wozniak)\ **Replies:** 0\ **Last updated:** [May 9, 2021, 11:06am UTC](https://discuss.elastic.co/t/winlogbeat-parsing-message-field/272497 "2021-05-09T11:06:04Z")
Greetings! I'm using basic setup that uses Winlogbeat with configured sysmon. I'm writing some correlation rules and I would like to detect whether powershell command is suspiciously long. The command itself is in "mes… --- ## [Recommendation for number of master nodes in a large cluster having 250 data nodes](https://discuss.elastic.co/t/recommendation-for-number-of-master-nodes-in-a-large-cluster-having-250-data-nodes/272510)
**Author:** [@Praveen\_Atluri](https://discuss.elastic.co/u/Praveen_Atluri)\ **Replies:** 4\ **Last updated:** [May 10, 2021, 12:15am UTC](https://discuss.elastic.co/t/recommendation-for-number-of-master-nodes-in-a-large-cluster-having-250-data-nodes/272510 "2021-05-10T00:15:20Z")
Hi All, Is there any recommendation for how many master nodes must be there for a large cluster containing 250 data nodes? When we monitor the thread pool of each data node in the cluster, I see some tasks that are re… --- ## [Filebeat processor syntax 7.12.1](https://discuss.elastic.co/t/filebeat-processor-syntax-7-12-1/271768)
**Author:** [@Adriann](https://discuss.elastic.co/u/Adriann)\ **Replies:** 12\ **Last updated:** [May 9, 2021, 9:51pm UTC](https://discuss.elastic.co/t/filebeat-processor-syntax-7-12-1/271768 "2021-05-09T21:51:40Z")
Hello, I want to add some fields explanation because names that are provided via logs are not self-explaining enough. I guess It's best to do this operation on filebeat level to not use resources during the pipeline pro… --- ## [Iterate through data in field logstash](https://discuss.elastic.co/t/iterate-through-data-in-field-logstash/272518)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 1\ **Last updated:** [May 9, 2021, 9:33pm UTC](https://discuss.elastic.co/t/iterate-through-data-in-field-logstash/272518 "2021-05-09T21:33:45Z")
Hi all I have a field like this field: 10, 20, 30, 40 now that i want to make each of the data in the field to be parse like this: field.1: 10 field.2: 20 ... and then use the translate plugin on each of these field… --- ## [Send all Syslog messages that don't match output to another index?](https://discuss.elastic.co/t/send-all-syslog-messages-that-dont-match-output-to-another-index/272418)
**Author:** [@jeromeat](https://discuss.elastic.co/u/jeromeat)\ **Replies:** 2\ **Last updated:** [May 9, 2021, 9:22pm UTC](https://discuss.elastic.co/t/send-all-syslog-messages-that-dont-match-output-to-another-index/272418 "2021-05-09T21:22:02Z")
Noob here, so don't judge too hard. :wink: However, I am wanting to find out if it's possible to have an output as such that's looking for specific tags and sending those messages to the windows\* index but if they don'… --- ## [Elasticsearch node stats write threadpool](https://discuss.elastic.co/t/elasticsearch-node-stats-write-threadpool/272516)
**Author:** [@Praveen\_Atluri](https://discuss.elastic.co/u/Praveen_Atluri)\ **Replies:** 1\ **Last updated:** [May 9, 2021, 6:49pm UTC](https://discuss.elastic.co/t/elasticsearch-node-stats-write-threadpool/272516 "2021-05-09T18:49:55Z")
When I checked the node stats for some of my nodes, I see below for write thread pool. "write" : { "threads" : 8, "queue" : 13, "active" : 8, "rejected" : 19958, "large… --- ## [Index lifecycle error](https://discuss.elastic.co/t/index-lifecycle-error/271200)
**Author:** [@alfredo.deluca](https://discuss.elastic.co/u/alfredo.deluca)\ **Replies:** 4\ **Last updated:** [May 9, 2021, 5:52pm UTC](https://discuss.elastic.co/t/index-lifecycle-error/271200 "2021-05-09T17:52:27Z")
Hi all. We have elastic cloud 7.12 I am getting the following errors on the lifecycle for all the new policy I ve put in place. Any idea? illegal\_argument\_exception: setting \[index.lifecycle.rollover\_alias\] for index … --- ## [How to do log rotation in Elastic Search](https://discuss.elastic.co/t/how-to-do-log-rotation-in-elastic-search/272442)
**Author:** [@german\_83](https://discuss.elastic.co/u/german_83)\ **Replies:** 1\ **Last updated:** [May 9, 2021, 2:34pm UTC](https://discuss.elastic.co/t/how-to-do-log-rotation-in-elastic-search/272442 "2021-05-09T14:34:07Z")
Hi all, I have setup a deployment for elasticsearch and I been able to make it work with winlogbeat to capture specific events, But I'm not sure how to rotate the logs with the index lifecycle management policies I'm no… --- ## [Logstash ambiguous port definition](https://discuss.elastic.co/t/logstash-ambiguous-port-definition/272494)
**Author:** [@Roy\_Levy](https://discuss.elastic.co/u/Roy_Levy)\ **Replies:** 2\ **Last updated:** [May 9, 2021, 2:15pm UTC](https://discuss.elastic.co/t/logstash-ambiguous-port-definition/272494 "2021-05-09T14:15:51Z")
Hey, I am using Logstash in order to push documents to elasticsearch, and when trying to run logstash I'm getting the error: \[2021-05-09T08:45:57,532\]\[DEBUG\]\[logstash.javapipeline \]\[main\] Pipeline terminated by work… --- ## [Goes through data in a field to parse](https://discuss.elastic.co/t/goes-through-data-in-a-field-to-parse/272429)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 2\ **Last updated:** [May 9, 2021, 1:31pm UTC](https://discuss.elastic.co/t/goes-through-data-in-a-field-to-parse/272429 "2021-05-09T13:31:53Z")
Hi all I have some problems with parse data in logstash i have a field with value like this: testValue: 1,2,3,4 and i have an yaml file to map data like this: 1: some1 2: some2 3: some3 i want to parse the data to … --- ## [Patterns, Best Practices.... for Ingesting large SQL multi-table/multi-relationship data into ES](https://discuss.elastic.co/t/patterns-best-practices-for-ingesting-large-sql-multi-table-multi-relationship-data-into-es/272498)
**Author:** [@lbi2000](https://discuss.elastic.co/u/lbi2000)\ **Replies:** 0\ **Last updated:** [May 9, 2021, 11:55am UTC](https://discuss.elastic.co/t/patterns-best-practices-for-ingesting-large-sql-multi-table-multi-relationship-data-into-es/272498 "2021-05-09T11:55:44Z")
Hi All. Great product. Keep up the great work please and continue to "push" into use cases not just for focus of log analysis...but please push the envelope for those like my project that have dumped SQL databases for … --- ## [How can we use the beats-provided Kibana dashboards but use a custom index-pattern name?](https://discuss.elastic.co/t/how-can-we-use-the-beats-provided-kibana-dashboards-but-use-a-custom-index-pattern-name/271282)
**Author:** [@Husnain](https://discuss.elastic.co/u/Husnain)\ **Replies:** 5\ **Last updated:** [May 9, 2021, 11:26am UTC](https://discuss.elastic.co/t/how-can-we-use-the-beats-provided-kibana-dashboards-but-use-a-custom-index-pattern-name/271282 "2021-05-09T11:26:11Z")
Hii,I am using Filebeat 7.12.0 to ingest netflow flows and store it into elasticsearch.I want to load the example dashboards of filebeat but with an index pattern different than filebeat-\*.How can I do this? I am running… --- ## [How to add data\_hot node type to es cluster using helm?](https://discuss.elastic.co/t/how-to-add-data-hot-node-type-to-es-cluster-using-helm/272495)
**Author:** [@fahem](https://discuss.elastic.co/u/fahem)\ **Replies:** 0\ **Last updated:** [May 9, 2021, 10:11am UTC](https://discuss.elastic.co/t/how-to-add-data-hot-node-type-to-es-cluster-using-helm/272495 "2021-05-09T10:11:50Z")
Hello, I would like to add data\_hot node type to my es cluster (not just data node), i saw https://github.com/elastic/helm-charts/blob/master/elasticsearch/examples/multi/data.yaml page but it implements data node onl… --- ## [Auditbeat system overview ECS](https://discuss.elastic.co/t/auditbeat-system-overview-ecs/272469)
**Author:** [@logger](https://discuss.elastic.co/u/logger)\ **Replies:** 2\ **Last updated:** [May 9, 2021, 8:54am UTC](https://discuss.elastic.co/t/auditbeat-system-overview-ecs/272469 "2021-05-09T08:54:11Z")
Hi there, Running elasticsearch and kibana as a docker with version 7.12.1 and auditbeat on two hosts with also version 7.12.1 Everything is running fine. I just have found an issue in the Auditbeat System Overview Da… --- ## [Kibana Slow Response After Enabling ELK Security](https://discuss.elastic.co/t/kibana-slow-response-after-enabling-elk-security/271182)
**Author:** [@k.karami](https://discuss.elastic.co/u/k.karami)\ **Replies:** 1\ **Last updated:** [May 9, 2021, 5:37am UTC](https://discuss.elastic.co/t/kibana-slow-response-after-enabling-elk-security/271182 "2021-05-09T05:37:53Z")
Hi, We have a basic license single node cluster (elastic 7.12.0 and kibana 7.12.0 ) on premise running on docker in a Linux node using http ( http://localhost:9200 and http://localhost:5601 ). Couple of weeks ago I en… --- ## [Kibana Monitoring Issue and Sharding Problem](https://discuss.elastic.co/t/kibana-monitoring-issue-and-sharding-problem/271219)
**Author:** [@Farid\_N](https://discuss.elastic.co/u/Farid_N)\ **Replies:** 13\ **Last updated:** [May 8, 2021, 8:36am UTC](https://discuss.elastic.co/t/kibana-monitoring-issue-and-sharding-problem/271219 "2021-05-08T08:36:37Z")
Hi there I have 2 problems which is probably related to each other: I have a basic cluster with 2 nodes of data. But my status is always "Yellow" and these 2nodes can not divide the primary shards and replicas: So I … --- ## [LogStash update fields received](https://discuss.elastic.co/t/logstash-update-fields-received/272480)
**Author:** [@Hamza\_El\_Aouane](https://discuss.elastic.co/u/Hamza_El_Aouane)\ **Replies:** 0\ **Last updated:** [May 8, 2021, 10:14pm UTC](https://discuss.elastic.co/t/logstash-update-fields-received/272480 "2021-05-08T22:14:48Z")
Hello guys. I hope everyone is doing well. I am a bit confused about ELK, specifically about LogStash and I hope you can help me to clarify this issue. A couple of weeks ago, one of our clients started forwarding syslo… --- ## [Filebeat not pushing log to Logstash](https://discuss.elastic.co/t/filebeat-not-pushing-log-to-logstash/272478)
**Author:** [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Replies:** 0\ **Last updated:** [May 8, 2021, 10:07pm UTC](https://discuss.elastic.co/t/filebeat-not-pushing-log-to-logstash/272478 "2021-05-08T22:07:11Z")
Hi All, I am using ELK stack 7.6.2. The log does not get pushed from Filebeat to Logstash for some reason. The log /opt/ttcmkts/work/bcdcommoncache/bcd.log is rolling very fast. My logstash conf file looks like bel… --- ## [Dynamically add keyword field to text field](https://discuss.elastic.co/t/dynamically-add-keyword-field-to-text-field/272427)
**Author:** [@peterol](https://discuss.elastic.co/u/peterol)\ **Replies:** 1\ **Last updated:** [May 8, 2021, 6:47pm UTC](https://discuss.elastic.co/t/dynamically-add-keyword-field-to-text-field/272427 "2021-05-08T18:47:47Z")
Hello everyone, I have various fields i want to index as text and keyword from Logstash. I'm using an index template with static mappings to define data types and analyzers for my fields that look like these: "field.n… --- ## [Help with manging storage for a large index](https://discuss.elastic.co/t/help-with-manging-storage-for-a-large-index/272447)
**Author:** [@predev](https://discuss.elastic.co/u/predev)\ **Replies:** 5\ **Last updated:** [May 8, 2021, 5:32pm UTC](https://discuss.elastic.co/t/help-with-manging-storage-for-a-large-index/272447 "2021-05-08T17:32:14Z")
Hi, We are a new start-up going through development with no funding other than out our own pocket, I am hoping to seek some advice from others who are far more experienced than myself given we have only used Elasticsear… --- ## [Importing csv met date format error](https://discuss.elastic.co/t/importing-csv-met-date-format-error/272457)
**Author:** [@Jeff-Tian](https://discuss.elastic.co/u/Jeff-Tian)\ **Replies:** 3\ **Last updated:** [May 8, 2021, 2:38pm UTC](https://discuss.elastic.co/t/importing-csv-met-date-format-error/272457 "2021-05-08T14:38:26Z")
I'm quite new on kibana and I met the following error when importing csv file: File could not be read \[illegal\_argument\_exception\] failed to parse date field \[3/3/2021 21:40:25.76\] with format \[d/M/… --- ## [Filter out better results](https://discuss.elastic.co/t/filter-out-better-results/272471)
**Author:** [@lq-0519](https://discuss.elastic.co/u/lq-0519)\ **Replies:** 2\ **Last updated:** [May 8, 2021, 12:36pm UTC](https://discuss.elastic.co/t/filter-out-better-results/272471 "2021-05-08T12:36:28Z")
Everyone, I have a small problem. Now there is a situation. There are more than 100000 documents in my index. When I use 'match' to search, there may be thousands of results. But maybe I just need the first few of these … --- ## [How to assign each word's weight in a query?](https://discuss.elastic.co/t/how-to-assign-each-words-weight-in-a-query/272430)
**Author:** [@xiaoma](https://discuss.elastic.co/u/xiaoma)\ **Replies:** 2\ **Last updated:** [May 8, 2021, 11:53am UTC](https://discuss.elastic.co/t/how-to-assign-each-words-weight-in-a-query/272430 "2021-05-08T11:53:22Z")
hello guys, I want to assign different weight for each words in a query (i have an important word set) For example: Query : "the elastic guide book" , the word "elastic " is supposed to an important word, which weig… --- ## [Impact of enabling \`eager\_global\_ordinals\` on production traffic](https://discuss.elastic.co/t/impact-of-enabling-eager-global-ordinals-on-production-traffic/272411)
**Author:** [@rchougule](https://discuss.elastic.co/u/rchougule)\ **Replies:** 3\ **Last updated:** [May 8, 2021, 9:34am UTC](https://discuss.elastic.co/t/impact-of-enabling-eager-global-ordinals-on-production-traffic/272411 "2021-05-08T09:34:11Z")
Hello, I was wondering regarding the impact eager\_global\_ordinals: true would have as soon as I enable it on prod. As in, will it impact the ongoing production traffic? If yes, any idea how can I gauge this before enab… --- ## [Continuing a discussion,\_component\_template API got error, very anxious](https://discuss.elastic.co/t/continuing-a-discussion-component-template-api-got-error-very-anxious/272464)
**Author:** [@carpeDiem](https://discuss.elastic.co/u/carpeDiem)\ **Replies:** 1\ **Last updated:** [May 8, 2021, 8:34am UTC](https://discuss.elastic.co/t/continuing-a-discussion-component-template-api-got-error-very-anxious/272464 "2021-05-08T08:34:53Z")
Continuing the discussion from \_component\_template API got error: --- ## [\_component\_template API got error](https://discuss.elastic.co/t/component-template-api-got-error/272353)
**Author:** [@carpeDiem](https://discuss.elastic.co/u/carpeDiem)\ **Replies:** 1\ **Last updated:** [May 8, 2021, 8:33am UTC](https://discuss.elastic.co/t/component-template-api-got-error/272353 "2021-05-08T08:33:54Z")
Continuing the discussion from \_component\_template APT got error: --- ## [Multiple fields wild card bool query](https://discuss.elastic.co/t/multiple-fields-wild-card-bool-query/272460)
**Author:** [@Mithoon](https://discuss.elastic.co/u/Mithoon)\ **Replies:** 0\ **Last updated:** [May 8, 2021, 5:43am UTC](https://discuss.elastic.co/t/multiple-fields-wild-card-bool-query/272460 "2021-05-08T05:43:46Z")
Currently using below bool query which searches for a combination of all input words or either one of input word on the field "Name". How to query on multiple fields using wild cards? POST inventory\_dev/\_search { "fro… --- ## [Functionbeats and Role Name Error](https://discuss.elastic.co/t/functionbeats-and-role-name-error/272454)
**Author:** [@gonrial](https://discuss.elastic.co/u/gonrial)\ **Replies:** 0\ **Last updated:** [May 7, 2021, 10:39pm UTC](https://discuss.elastic.co/t/functionbeats-and-role-name-error/272454 "2021-05-07T22:39:33Z")
I have an error when building a functionbeat lambda to ship other lambdas logs to elastic cloud. The reason is that the name is too long. According to the documentation should be ~20 chars long, but in this case is 16 c… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1423) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1425)