# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1456 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1457 --- ## [Kibana setting Alerts/Anomalies to email](https://discuss.elastic.co/t/kibana-setting-alerts-anomalies-to-email/270590)
**Author:** [@miklin](https://discuss.elastic.co/u/miklin)\ **Replies:** 1\ **Last updated:** [April 19, 2021, 6:01pm UTC](https://discuss.elastic.co/t/kibana-setting-alerts-anomalies-to-email/270590 "2021-04-19T18:01:35Z")
Hi, I'm taking the Kibana training courses and have a quick question. Is it possible to set an email alert on Kibana? If it's doable, how can I set up? (There are training sessions on Machine learning in Elastic Stack a… --- ## [Lucene Merge Thread causing high CPU usage](https://discuss.elastic.co/t/lucene-merge-thread-causing-high-cpu-usage/270599)
**Author:** [@souravsahoo](https://discuss.elastic.co/u/souravsahoo)\ **Replies:** 2\ **Last updated:** [April 19, 2021, 5:37pm UTC](https://discuss.elastic.co/t/lucene-merge-thread-causing-high-cpu-usage/270599 "2021-04-19T17:37:06Z")
Hi all, I have been facing issue with elasticsearch consuming a very high CPU i.e., 80-100% when a heavy data load is ingested. Below are few inputs:- Elasticsearch is running on. 7.10.2 version We have data tier arc… --- ## [Threat Intel module](https://discuss.elastic.co/t/threat-intel-module/269679)
**Author:** [@sbathla](https://discuss.elastic.co/u/sbathla)\ **Replies:** 2\ **Last updated:** [April 19, 2021, 5:15pm UTC](https://discuss.elastic.co/t/threat-intel-module/269679 "2021-04-19T17:15:39Z")
Hi all, Need one help. I tried to integrate threat intel module in 7.12 version. Post integration I am able to view dashboard for Abuse URL and Abuse malware but not getting results for MISP, Otx, alienvault..Did the re… --- ## [Unable to receive source fields over email from Watcher alerting](https://discuss.elastic.co/t/unable-to-receive-source-fields-over-email-from-watcher-alerting/269914)
**Author:** [@arunhk3](https://discuss.elastic.co/u/arunhk3)\ **Replies:** 5\ **Last updated:** [April 19, 2021, 3:44pm UTC](https://discuss.elastic.co/t/unable-to-receive-source-fields-over-email-from-watcher-alerting/269914 "2021-04-19T15:44:06Z")
Hi All, I have been trying for nearly 4 hours already to get an email alert with data table using Watcher, despite receiving the email it fails to send the data using the \_source fields specified. My Watcher alert is as… --- ## [How to create a comma separated KQL filter of field values with a colon](https://discuss.elastic.co/t/how-to-create-a-comma-separated-kql-filter-of-field-values-with-a-colon/270487)
**Author:** [@DanielV](https://discuss.elastic.co/u/DanielV)\ **Replies:** 3\ **Last updated:** [April 19, 2021, 3:30pm UTC](https://discuss.elastic.co/t/how-to-create-a-comma-separated-kql-filter-of-field-values-with-a-colon/270487 "2021-04-19T15:30:28Z")
One of the fields of the index I'm querying is 'sessionid' , it also has a sessionid.keyword field variant. Values contain a colon. Examples: 136:11 99:5 What I'm trying to accomplish is a filter in the KQL-query bar… --- ## [How to make it work?!](https://discuss.elastic.co/t/how-to-make-it-work/270534)
**Author:** [@tennaen](https://discuss.elastic.co/u/tennaen)\ **Replies:** 2\ **Last updated:** [April 19, 2021, 2:58pm UTC](https://discuss.elastic.co/t/how-to-make-it-work/270534 "2021-04-19T14:58:43Z")
Dears, i have a problem and i cannot deal with it. In my pipeline configuration i have this code: if "%{\[process\]\[thread\]\[id\]}" =~ "\[a-z0-9\]+/\[a-z0-9\]+" { mutate { split =\> { "\[process\]\[thr… --- ## [Kibana with routing awareness](https://discuss.elastic.co/t/kibana-with-routing-awareness/270582)
**Author:** [@GabrielM](https://discuss.elastic.co/u/GabrielM)\ **Replies:** 4\ **Last updated:** [April 19, 2021, 2:38pm UTC](https://discuss.elastic.co/t/kibana-with-routing-awareness/270582 "2021-04-19T14:38:51Z")
Hello everyone, I just saw that ElasticSearch is able to route requests according to the attributes attached to the cluster nodes (Cluster-level shard allocation and routing settings | Elasticsearch Guide \[7.7\] | Elastic)… --- ## [Reindex automatization - detection of failures / missing documents](https://discuss.elastic.co/t/reindex-automatization-detection-of-failures-missing-documents/270594)
**Author:** [@plachor](https://discuss.elastic.co/u/plachor)\ **Replies:** 0\ **Last updated:** [April 19, 2021, 2:13pm UTC](https://discuss.elastic.co/t/reindex-automatization-detection-of-failures-missing-documents/270594 "2021-04-19T14:13:59Z")
Hi, I'm trying to automatize reindex operation. I'm looking for a robust way to determine that my reindex operation was indeed successful before start using new indexes. I always start reindex as an asynchronous operatio… --- ## [Performance Issue with Elasticsearch 7.11.1 Cluster](https://discuss.elastic.co/t/performance-issue-with-elasticsearch-7-11-1-cluster/270592)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 0\ **Last updated:** [April 19, 2021, 2:03pm UTC](https://discuss.elastic.co/t/performance-issue-with-elasticsearch-7-11-1-cluster/270592 "2021-04-19T14:03:55Z")
Hi, We've had an issue show itself in recent days with one of our clusters. High level behaviour is as follows: Ingestion Rate has collapsed 504 errors reported by logstash One node showing exceptionally high load ave… --- ## [Relative index time metrics?](https://discuss.elastic.co/t/relative-index-time-metrics/270583)
**Author:** [@alsyia](https://discuss.elastic.co/u/alsyia)\ **Replies:** 2\ **Last updated:** [April 19, 2021, 1:55pm UTC](https://discuss.elastic.co/t/relative-index-time-metrics/270583 "2021-04-19T13:55:11Z")
Hello, I'm running ESRally against an existing (test/staging) cluster (whose traffic I can stop if needed for the benchmark duration) and I would like to compare the resulting benchmark against a new, empty cluster. I'm… --- ## [%{\[Logs\]\[NET\] meaning](https://discuss.elastic.co/t/logs-net-meaning/270569)
**Author:** [@dddddddddddddddd](https://discuss.elastic.co/u/dddddddddddddddd)\ **Replies:** 1\ **Last updated:** [April 19, 2021, 1:26pm UTC](https://discuss.elastic.co/t/logs-net-meaning/270569 "2021-04-19T13:26:51Z")
what is the meaning of index =\> "%{\[Logs\]\[NET\]-%{+YYYY.MM.dd}}" thanks --- ## [Kibana Reports PDF export](https://discuss.elastic.co/t/kibana-reports-pdf-export/270477)
**Author:** [@prajganesh](https://discuss.elastic.co/u/prajganesh)\ **Replies:** 3\ **Last updated:** [April 19, 2021, 12:04pm UTC](https://discuss.elastic.co/t/kibana-reports-pdf-export/270477 "2021-04-19T12:04:22Z")
I'm having a basic Kibana for research purposes. How can I export Kibana dashboards to PDF? Is there any basic subscription for PDF export. I need it for On-prem and used only for personal development. Thanks for the he… --- ## [\[Filebeat 7.12\] \[Windows\] Failed to open store 'filebeat' after incorrect Windows reboot](https://discuss.elastic.co/t/filebeat-7-12-windows-failed-to-open-store-filebeat-after-incorrect-windows-reboot/270145)
**Author:** [@akelio](https://discuss.elastic.co/u/akelio)\ **Replies:** 2\ **Last updated:** [April 19, 2021, 12:01pm UTC](https://discuss.elastic.co/t/filebeat-7-12-windows-failed-to-open-store-filebeat-after-incorrect-windows-reboot/270145 "2021-04-19T12:01:32Z")
Hi! Filebeat 7.12 (x86) on Windows machine cannot start after incorrect OS reboot (possibly after power supply lost). Log shows that registry data files are corrupted. The only way I found to manually start filebeat is… --- ## [How to graph collapse search results?](https://discuss.elastic.co/t/how-to-graph-collapse-search-results/270349)
**Author:** [@Glen\_Ogilvie](https://discuss.elastic.co/u/Glen_Ogilvie)\ **Replies:** 1\ **Last updated:** [April 19, 2021, 11:59am UTC](https://discuss.elastic.co/t/how-to-graph-collapse-search-results/270349 "2021-04-19T11:59:47Z")
I've written a search that uses collapse: To get the latest records from a time series, that I would then like to graph. I can't however find a reasonable way in Kibana to do this, with the best I've found is the top\_… --- ## [Filebeats high IO WAIT version 7.9.2](https://discuss.elastic.co/t/filebeats-high-io-wait-version-7-9-2/270575)
**Author:** [@Ankur\_Mahajan](https://discuss.elastic.co/u/Ankur_Mahajan)\ **Replies:** 0\ **Last updated:** [April 19, 2021, 11:26am UTC](https://discuss.elastic.co/t/filebeats-high-io-wait-version-7-9-2/270575 "2021-04-19T11:26:07Z")
We are randomly facing a weird issue of IO wait with filebeat 7.9.2. We have around 30 filebeat, metricbeat and heartbeat pipeline to an elasticsearch cluster. I searched this a lot but couldn't find a solution. The ugl… --- ## [Error in Elasticsearch master pod that FileSystemException: /data/log: Input/output error](https://discuss.elastic.co/t/error-in-elasticsearch-master-pod-that-filesystemexception-data-log-input-output-error/270379)
**Author:** [@subha1](https://discuss.elastic.co/u/subha1)\ **Replies:** 2\ **Last updated:** [April 19, 2021, 11:15am UTC](https://discuss.elastic.co/t/error-in-elasticsearch-master-pod-that-filesystemexception-data-log-input-output-error/270379 "2021-04-19T11:15:59Z")
I found the below error logs in Elasticsearch master pod logs- Caused by: java.lang.IllegalStateException: Unable to access 'path.logs' (/data/log) at org.elasticsearch.bootstrap.FilePermissionUtils.addDirector… --- ## [How to delete a mapping field of an index?](https://discuss.elastic.co/t/how-to-delete-a-mapping-field-of-an-index/270371)
**Author:** [@KeithTt](https://discuss.elastic.co/u/KeithTt)\ **Replies:** 2\ **Last updated:** [April 19, 2021, 11:12am UTC](https://discuss.elastic.co/t/how-to-delete-a-mapping-field-of-an-index/270371 "2021-04-19T11:12:34Z")
I followed this page: Update mapping API | Elasticsearch Guide \[master\] | Elastic It seems ES does not support delete a mapping field directly? --- ## [How to reflect the DELETE operations in ES logs](https://discuss.elastic.co/t/how-to-reflect-the-delete-operations-in-es-logs/270564)
**Author:** [@yuriy.kasterin](https://discuss.elastic.co/u/yuriy.kasterin)\ **Replies:** 0\ **Last updated:** [April 19, 2021, 10:35am UTC](https://discuss.elastic.co/t/how-to-reflect-the-delete-operations-in-es-logs/270564 "2021-04-19T10:35:03Z")
Hello. I have an issue on ES server that an old records are constantly disappear from the server after 15 days. I have checked all the relevant logs related to an application that indexes a new records into ES server a… --- ## [Elasticsearch deletes my index out of nowhere](https://discuss.elastic.co/t/elasticsearch-deletes-my-index-out-of-nowhere/270551)
**Author:** [@Nikolaj\_Karpov](https://discuss.elastic.co/u/Nikolaj_Karpov)\ **Replies:** 5\ **Last updated:** [April 19, 2021, 10:27am UTC](https://discuss.elastic.co/t/elasticsearch-deletes-my-index-out-of-nowhere/270551 "2021-04-19T10:27:18Z")
I have Elasticsearch server on AWS . And every now and then my Elasticsearch index is being somehow deleted without me doing anything. Below are the logs from my Elasticsearch server. \[2021-04-19T01:30:00,001\]\[INFO… --- ## [How to sort my time field in descending order with size 1 to get graph with only the latest documents?](https://discuss.elastic.co/t/how-to-sort-my-time-field-in-descending-order-with-size-1-to-get-graph-with-only-the-latest-documents/270494)
**Author:** [@Shalhevet](https://discuss.elastic.co/u/Shalhevet)\ **Replies:** 2\ **Last updated:** [April 19, 2021, 10:24am UTC](https://discuss.elastic.co/t/how-to-sort-my-time-field-in-descending-order-with-size-1-to-get-graph-with-only-the-latest-documents/270494 "2021-04-19T10:24:29Z")
Hi. I have Vega-lite code for a graph in kibana. I need to sort my time field in descending order with size 1 in order to get the documents belonging to the latest time. I know I need to use the following lines, but I… --- ## [Find all documents containing array object field of size 0 or more](https://discuss.elastic.co/t/find-all-documents-containing-array-object-field-of-size-0-or-more/270562)
**Author:** [@dheeru4elastic](https://discuss.elastic.co/u/dheeru4elastic)\ **Replies:** 0\ **Last updated:** [April 19, 2021, 9:53am UTC](https://discuss.elastic.co/t/find-all-documents-containing-array-object-field-of-size-0-or-more/270562 "2021-04-19T09:53:14Z")
Please find below the sample documents that I have in my elasticsearch 7.7.0. How can i build a optimize query to fetch all the documents that contains the array field problemInvestigations . As you can see some document… --- ## [Aws plugin installation problem](https://discuss.elastic.co/t/aws-plugin-installation-problem/270085)
**Author:** [@Weathmious](https://discuss.elastic.co/u/Weathmious)\ **Replies:** 20\ **Last updated:** [April 19, 2021, 9:23am UTC](https://discuss.elastic.co/t/aws-plugin-installation-problem/270085 "2021-04-19T09:23:06Z")
Hello, In order to send my elasticsearch indexes to aws S3, I find myself having to install the aws-cloud plugin on my server For that, I have to enter this order while being in the file /usr/share/elasticsearch: sudo… --- ## [Snmp mib yamlmibdir](https://discuss.elastic.co/t/snmp-mib-yamlmibdir/270554)
**Author:** [@elastic\_study](https://discuss.elastic.co/u/elastic_study)\ **Replies:** 0\ **Last updated:** [April 19, 2021, 9:02am UTC](https://discuss.elastic.co/t/snmp-mib-yamlmibdir/270554 "2021-04-19T09:02:07Z")
How to convert a vendor mib file to an yaml mib ？ Is there any other tool？ --- ## [Shrink action turns cluster to yellow state](https://discuss.elastic.co/t/shrink-action-turns-cluster-to-yellow-state/270553)
**Author:** [@d4nnyx](https://discuss.elastic.co/u/d4nnyx)\ **Replies:** 0\ **Last updated:** [April 19, 2021, 8:51am UTC](https://discuss.elastic.co/t/shrink-action-turns-cluster-to-yellow-state/270553 "2021-04-19T08:51:08Z")
Hello, in our cluster we manage about 10K indices, all with ILM and every shrink action turns the cluster to yellow state, which is really annoying, because of our monitoring of cluster state. Is there any way to change… --- ## [Why elasticsearch mapping conflicts?](https://discuss.elastic.co/t/why-elasticsearch-mapping-conflicts/270544)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 0\ **Last updated:** [April 19, 2021, 7:49am UTC](https://discuss.elastic.co/t/why-elasticsearch-mapping-conflicts/270544 "2021-04-19T07:49:31Z")
I am facing some issues in elasticsearch mapping.Although i have check the forum the solution is reindexing but why? GET \_template/winlogbeat\_sysmon { "winlogbeat\_sysmon" : { "order" : 0, "index\_patterns" : \[ … --- ## [Could not index event to elasticsearch maximum shards open](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-maximum-shards-open/270524)
**Author:** [@TrAMT](https://discuss.elastic.co/u/TrAMT)\ **Replies:** 3\ **Last updated:** [April 19, 2021, 7:47am UTC](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-maximum-shards-open/270524 "2021-04-19T07:47:06Z")
Hi I have problem with Elasticsearch and Logstash. Here is the detail of log: Apr 16 13:01:24 elastic7-logstash logstash\[980\]: \[2021-04-16T13:01:24,828\]\[WARN \]\[logstash.outputs.elasticsearch\] Could not index event to E… --- ## [Template mapping not being applied](https://discuss.elastic.co/t/template-mapping-not-being-applied/269848)
**Author:** [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Replies:** 5\ **Last updated:** [April 19, 2021, 7:41am UTC](https://discuss.elastic.co/t/template-mapping-not-being-applied/269848 "2021-04-19T07:41:56Z")
Hello I am currently setting a mapping in my template but it seems to not be working. My work flow is basically Data -\> Logstash -\> Elasticsearch In Logstash, I do NOT set a template SO it gets the default, which is … --- ## [Exists query for field that has only 1 nested child not working](https://discuss.elastic.co/t/exists-query-for-field-that-has-only-1-nested-child-not-working/268897)
**Author:** [@MiDe](https://discuss.elastic.co/u/MiDe)\ **Replies:** 4\ **Last updated:** [April 19, 2021, 7:39am UTC](https://discuss.elastic.co/t/exists-query-for-field-that-has-only-1-nested-child-not-working/268897 "2021-04-19T07:39:20Z")
Trying to query entries based on a mapping like this: {"top": { "properties": { "doc": { "properties": { "A": { "properties": { "B": { "type… --- ## [Permission to generate CSV report](https://discuss.elastic.co/t/permission-to-generate-csv-report/270443)
**Author:** [@cyberzlo](https://discuss.elastic.co/u/cyberzlo)\ **Replies:** 1\ **Last updated:** [April 19, 2021, 7:21am UTC](https://discuss.elastic.co/t/permission-to-generate-csv-report/270443 "2021-04-19T07:21:13Z")
How can I add access to generating CSV? Reporting error You don't have permission to generate this report. But I can't find such privilege... --- ## [Pipelines disappeared](https://discuss.elastic.co/t/pipelines-disappeared/269806)
**Author:** [@Farid\_N](https://discuss.elastic.co/u/Farid_N)\ **Replies:** 5\ **Last updated:** [April 19, 2021, 6:31am UTC](https://discuss.elastic.co/t/pipelines-disappeared/269806 "2021-04-19T06:31:54Z")
Hi I had to restart Logstash service for some reason. In Kibana - Stack Monitoring - I had all the pipelines that was in pipeline.yml. But now(after restart) they don\`t appear in this page: I had at least 20 pipelin… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1455) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1457)