# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1486 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1487 --- ## [ILM - Frozen Tier - Searchable Snapshot](https://discuss.elastic.co/t/ilm-frozen-tier-searchable-snapshot/268599)
**Author:** [@austinsonger](https://discuss.elastic.co/u/austinsonger)\ **Replies:** 3\ **Last updated:** [March 29, 2021, 9:16pm UTC](https://discuss.elastic.co/t/ilm-frozen-tier-searchable-snapshot/268599 "2021-03-29T21:16:49Z")
Please read the image for my question: --- ## [Elasticsearch HighLevelRestClient batch call not updating field reliably](https://discuss.elastic.co/t/elasticsearch-highlevelrestclient-batch-call-not-updating-field-reliably/268642)
**Author:** [@MoOrth](https://discuss.elastic.co/u/MoOrth)\ **Replies:** 0\ **Last updated:** [March 29, 2021, 9:52am UTC](https://discuss.elastic.co/t/elasticsearch-highlevelrestclient-batch-call-not-updating-field-reliably/268642 "2021-03-29T09:52:01Z")
Description of the problem including expected versus actual behavior: We noticed a strange behavior with one of our ElasticSearch bulk refresh calls. If we try to update the stock field in our item index (we use one it… --- ## [Easily deploy the Elastic Stack on Azure](https://discuss.elastic.co/t/easily-deploy-the-elastic-stack-on-azure/268701)
**Author:** [@xeraa](https://discuss.elastic.co/u/xeraa)\ **Replies:** 0\ **Last updated:** [March 29, 2021, 8:39pm UTC](https://discuss.elastic.co/t/easily-deploy-the-elastic-stack-on-azure/268701 "2021-03-29T20:39:47Z")
Hello! The Elastic team is currently working on a deep integration on the Azure platform that will drastically simplify deploying and managing the Elastic Stack on Azure. We would love to get some feedback on this exciti… --- ## [Identifying the stale indices in Elasticsearch](https://discuss.elastic.co/t/identifying-the-stale-indices-in-elasticsearch/268537)
**Author:** [@vineethsuhas](https://discuss.elastic.co/u/vineethsuhas)\ **Replies:** 4\ **Last updated:** [March 29, 2021, 8:36pm UTC](https://discuss.elastic.co/t/identifying-the-stale-indices-in-elasticsearch/268537 "2021-03-29T20:36:01Z")
Hi, I want to delete the indices which are stale (Not being accessed since last month). Is there a way to identify the indices which are not in use since one month? I could not find any stats on the indices which corre… --- ## [Runtime error: slice bounds out of range when ingesting Powershell logs](https://discuss.elastic.co/t/runtime-error-slice-bounds-out-of-range-when-ingesting-powershell-logs/268699)
**Author:** [@ruffy91](https://discuss.elastic.co/u/ruffy91)\ **Replies:** 0\ **Last updated:** [March 29, 2021, 8:34pm UTC](https://discuss.elastic.co/t/runtime-error-slice-bounds-out-of-range-when-ingesting-powershell-logs/268699 "2021-03-29T20:34:05Z")
I am trying to ingest Powershell logs using winlogbeat 7.12 using the following configuration: - name: WEC-Powershell tags: \[forwarded\] processors: - script: when.equals.winlog.channel: Windows-PowerShell … --- ## [Parsing Logstash Message Fields](https://discuss.elastic.co/t/parsing-logstash-message-fields/268509)
**Author:** [@Micah\_Barsness](https://discuss.elastic.co/u/Micah_Barsness)\ **Replies:** 5\ **Last updated:** [March 29, 2021, 7:26pm UTC](https://discuss.elastic.co/t/parsing-logstash-message-fields/268509 "2021-03-29T19:26:13Z")
I currently have logstash sending to Elastic cloud - I'd like to get that message section parsed out a bit so that its not one giant section. Could someone help me with that? Here's my filter section - it is just the "o… --- ## [What exactly steps should take to import custom syslog to elk](https://discuss.elastic.co/t/what-exactly-steps-should-take-to-import-custom-syslog-to-elk/268673)
**Author:** [@Depressed](https://discuss.elastic.co/u/Depressed)\ **Replies:** 4\ **Last updated:** [March 29, 2021, 6:37pm UTC](https://discuss.elastic.co/t/what-exactly-steps-should-take-to-import-custom-syslog-to-elk/268673 "2021-03-29T18:37:41Z")
hi i'm new to elk and i wanted to know what exactly should i do to receive various syslog and proccess and define filed and make dashbord? i've read some articles that points to some filter ,rule and grok stuff that i d… --- ## [Rollover exception](https://discuss.elastic.co/t/rollover-exception/268433)
**Author:** [@Narayan\_Banik](https://discuss.elastic.co/u/Narayan_Banik)\ **Replies:** 4\ **Last updated:** [March 29, 2021, 6:26pm UTC](https://discuss.elastic.co/t/rollover-exception/268433 "2021-03-29T18:26:49Z")
Hello Experts, I'm using ES 7.1.0. One index is not rolling over after reached to 40GB. Old indices rolled over successfully. Here is the below error: { "indices" : { "classicapps-2021.03.25-000068" : { "i… --- ## [Convert parent doc to child doc in 6.6](https://discuss.elastic.co/t/convert-parent-doc-to-child-doc-in-6-6/268683)
**Author:** [@kgeographer](https://discuss.elastic.co/u/kgeographer)\ **Replies:** 0\ **Last updated:** [March 29, 2021, 5:54pm UTC](https://discuss.elastic.co/t/convert-parent-doc-to-child-doc-in-6-6/268683 "2021-03-29T17:54:03Z")
In a 6.6 index, I have a join field 'relation' like so: "relation": { "type": "join", "relations": { "parent": "child" } Several hundred parent docs need to become children to another existing parent doc. I h… --- ## [Unable to find source.geo.location filebeat aws module](https://discuss.elastic.co/t/unable-to-find-source-geo-location-filebeat-aws-module/268254)
**Author:** [@EvanGertis](https://discuss.elastic.co/u/EvanGertis)\ **Replies:** 6\ **Last updated:** [March 29, 2021, 5:35pm UTC](https://discuss.elastic.co/t/unable-to-find-source-geo-location-filebeat-aws-module/268254 "2021-03-29T17:35:55Z")
I would like to convert the following to a geo\_point type "location": { "properties": { "lat": { "type": "float" }, "lon": { … --- ## [Visualize 2 values evolution (sum) with a Pie chart](https://discuss.elastic.co/t/visualize-2-values-evolution-sum-with-a-pie-chart/268669)
**Author:** [@Anto1](https://discuss.elastic.co/u/Anto1)\ **Replies:** 1\ **Last updated:** [March 29, 2021, 5:08pm UTC](https://discuss.elastic.co/t/visualize-2-values-evolution-sum-with-a-pie-chart/268669 "2021-03-29T17:08:30Z")
Hello ! I'm kind of a beginner in creating Kibana visualizations, and I'm actually facing this issue : I have a lot of logs, and some are containing the following fields "inSuccess" (eg. 2), "inError" (eg. 1), which … --- ## [Logstash on linux machine to read files from remote Windows folder](https://discuss.elastic.co/t/logstash-on-linux-machine-to-read-files-from-remote-windows-folder/268458)
**Author:** [@gukutini](https://discuss.elastic.co/u/gukutini)\ **Replies:** 3\ **Last updated:** [March 29, 2021, 4:48pm UTC](https://discuss.elastic.co/t/logstash-on-linux-machine-to-read-files-from-remote-windows-folder/268458 "2021-03-29T16:48:31Z")
I have logstash installed on ubuntu machine and use file input to read log files. I need read files from remote folder of Windows machine. For more convenience I mounted remote folder of Windows machine to my Ubuntu f… --- ## [Error building metricbeat 7.12.0](https://discuss.elastic.co/t/error-building-metricbeat-7-12-0/268425)
**Author:** [@Anna\_Yan](https://discuss.elastic.co/u/Anna_Yan)\ **Replies:** 5\ **Last updated:** [March 29, 2021, 4:47pm UTC](https://discuss.elastic.co/t/error-building-metricbeat-7-12-0/268425 "2021-03-29T16:47:59Z")
Hi, I'm trying to build metricbeat v7.12.0 and I'm getting this error: ~/beats/metricbeat PLATFORMS=linux/amd64 make release  2 ↵  10463  17:5… --- ## [Kibana grok patterns match exact string](https://discuss.elastic.co/t/kibana-grok-patterns-match-exact-string/268257)
**Author:** [@alidrsn](https://discuss.elastic.co/u/alidrsn)\ **Replies:** 3\ **Last updated:** [March 29, 2021, 4:26pm UTC](https://discuss.elastic.co/t/kibana-grok-patterns-match-exact-string/268257 "2021-03-29T16:26:48Z")
Hello there, I want to ingest a log with grok patterns in kibana. The log time format is slightly different from ready-made drafts as belove. 03/24 21:56:55.300 INFO Security..... Time Format -\> dd/MM hh:mm:ss.SSS … --- ## [How to get different Exceptions volume /count occured in given Pod in Kibana](https://discuss.elastic.co/t/how-to-get-different-exceptions-volume-count-occured-in-given-pod-in-kibana/268167)
**Author:** [@mvrnaidu](https://discuss.elastic.co/u/mvrnaidu)\ **Replies:** 1\ **Last updated:** [March 29, 2021, 3:51pm UTC](https://discuss.elastic.co/t/how-to-get-different-exceptions-volume-count-occured-in-given-pod-in-kibana/268167 "2021-03-29T15:51:05Z")
I have some 6 pods running in a container and i need to get all types of Exceptions from their logs by day wise, and also need to get alerts everyday to my email box .how to implement this in Kibana ? thanks in adva… --- ## [Add new values to the field if not available](https://discuss.elastic.co/t/add-new-values-to-the-field-if-not-available/266881)
**Author:** [@Shashankdevaraj](https://discuss.elastic.co/u/Shashankdevaraj)\ **Replies:** 1\ **Last updated:** [March 29, 2021, 3:35pm UTC](https://discuss.elastic.co/t/add-new-values-to-the-field-if-not-available/266881 "2021-03-29T15:35:45Z")
I am splitting the rows on a field called names, if some names are not available in a given time frame I want to add it and display NA across other columns. Please help. Example table: name country state n1 c1 … --- ## [Fleet AWS integration - looking for more info howto setup (IAM role preferred)](https://discuss.elastic.co/t/fleet-aws-integration-looking-for-more-info-howto-setup-iam-role-preferred/267844)
**Author:** [@wmeensvwpfs](https://discuss.elastic.co/u/wmeensvwpfs)\ **Replies:** 4\ **Last updated:** [March 29, 2021, 3:31pm UTC](https://discuss.elastic.co/t/fleet-aws-integration-looking-for-more-info-howto-setup-iam-role-preferred/267844 "2021-03-29T15:31:52Z")
Hi all, I'm running ECK 1.4.0 on AWS EKS. Elasticsearch and Kibana version is 7.11.2. First off, awesome how it's all shaping up! Also including innovations around Fleet and the Elastic Agent. Really exciting stuff!! A… --- ## ["cannot divide by 0" TinyMath error in Visual builder](https://discuss.elastic.co/t/cannot-divide-by-0-tinymath-error-in-visual-builder/268251)
**Author:** [@preetish\_P](https://discuss.elastic.co/u/preetish_P)\ **Replies:** 2\ **Last updated:** [March 29, 2021, 3:26pm UTC](https://discuss.elastic.co/t/cannot-divide-by-0-tinymath-error-in-visual-builder/268251 "2021-03-29T15:26:53Z")
Hello Elastic community, I am trying to build a metric in visual builder with 2 aggregations and a Math aggregation below them. But I am getting "Cannot divide by 0". Below is my structure of data: sr\_number some\_… --- ## [Data node high CPU usage - find job/query](https://discuss.elastic.co/t/data-node-high-cpu-usage-find-job-query/268666)
**Author:** [@MMH](https://discuss.elastic.co/u/MMH)\ **Replies:** 0\ **Last updated:** [March 29, 2021, 2:24pm UTC](https://discuss.elastic.co/t/data-node-high-cpu-usage-find-job-query/268666 "2021-03-29T14:24:18Z")
I am observing very high CPU usage on data nodes in my 7.9 ES cluster: It happens during "business hours" so I am suspecting one of the applications is issuing a query (or multiple queries) that is causing such high C… --- ## [Question: define default pipeline with different patterns depending on log.file.path](https://discuss.elastic.co/t/question-define-default-pipeline-with-different-patterns-depending-on-log-file-path/268636)
**Author:** [@Christos\_Gitsis](https://discuss.elastic.co/u/Christos_Gitsis)\ **Replies:** 2\ **Last updated:** [March 29, 2021, 3:13pm UTC](https://discuss.elastic.co/t/question-define-default-pipeline-with-different-patterns-depending-on-log-file-path/268636 "2021-03-29T15:13:53Z")
Hi, I would like to have my logs ingested by two different pipelines, depending on the log file which is the source of the document. Everything coming from /var/log/a.log should be processed by a\_pipeline everything f… --- ## [Elastic Search 5.1.1 - How to fetch all documents that contains/ startswith operator on a field in ElasticSearch](https://discuss.elastic.co/t/elastic-search-5-1-1-how-to-fetch-all-documents-that-contains-startswith-operator-on-a-field-in-elasticsearch/266945)
**Author:** [@HS161148](https://discuss.elastic.co/u/HS161148)\ **Replies:** 9\ **Last updated:** [March 29, 2021, 3:06pm UTC](https://discuss.elastic.co/t/elastic-search-5-1-1-how-to-fetch-all-documents-that-contains-startswith-operator-on-a-field-in-elasticsearch/266945 "2021-03-29T15:06:59Z")
How to fetch all documents that contains/ startswith with value on a field in ElasticSearch. --- ## [Mssql.performance ignores some metrics (metricbeat)](https://discuss.elastic.co/t/mssql-performance-ignores-some-metrics-metricbeat/268277)
**Author:** [@Francisco\_Gomez1](https://discuss.elastic.co/u/Francisco_Gomez1)\ **Replies:** 5\ **Last updated:** [March 29, 2021, 2:55pm UTC](https://discuss.elastic.co/t/mssql-performance-ignores-some-metrics-metricbeat/268277 "2021-03-29T14:55:18Z")
Hi. When im trying to use metricbeat to capture my SQL Server performance some metrics that should be included are completly ignored. this is my mssql.yml configuration: I should recieve all performance metrics but i… --- ## [How to use copy-to in filebeat?](https://discuss.elastic.co/t/how-to-use-copy-to-in-filebeat/268499)
**Author:** [@Chris6](https://discuss.elastic.co/u/Chris6)\ **Replies:** 2\ **Last updated:** [March 29, 2021, 2:42pm UTC](https://discuss.elastic.co/t/how-to-use-copy-to-in-filebeat/268499 "2021-03-29T14:42:21Z")
I am trying to use copy\_to to copy the values of multiple fields into a group field so that it can then be queried as a single field. I found this link copy\_to | Elasticsearch Reference \[7.12\] | Elastic , but when I try … --- ## ["Elastic did not load properly". Kibana failed loading in Browser](https://discuss.elastic.co/t/elastic-did-not-load-properly-kibana-failed-loading-in-browser/268043)
**Author:** [@DEEPTHI\_SONA\_G](https://discuss.elastic.co/u/DEEPTHI_SONA_G)\ **Replies:** 3\ **Last updated:** [March 29, 2021, 2:39pm UTC](https://discuss.elastic.co/t/elastic-did-not-load-properly-kibana-failed-loading-in-browser/268043 "2021-03-29T14:39:22Z")
I have tried installing Elasticsearch and kibana in centos7. Both of them are working fine. But when it come to loading kibana on browser we get the error " Elastic did not load properly. Check the server output for more… --- ## [How split function works in Timelion chart](https://discuss.elastic.co/t/how-split-function-works-in-timelion-chart/267728)
**Author:** [@ElasticQuestion\_1234](https://discuss.elastic.co/u/ElasticQuestion_1234)\ **Replies:** 6\ **Last updated:** [March 29, 2021, 2:26pm UTC](https://discuss.elastic.co/t/how-split-function-works-in-timelion-chart/267728 "2021-03-29T14:26:37Z")
I am trying to understand how the split function in Timelion chart works. .es(....,split=rows:256,...) For example, if I have 10K rows, if I split 10k, Kibana goes timeout right away. When I try split less than 256 row… --- ## [High performance](https://discuss.elastic.co/t/high-performance/267737)
**Author:** [@cyberzlo](https://discuss.elastic.co/u/cyberzlo)\ **Replies:** 13\ **Last updated:** [March 29, 2021, 1:51pm UTC](https://discuss.elastic.co/t/high-performance/267737 "2021-03-29T13:51:54Z")
How can I increace high performance of ES? Is this possible to do high performance cluster? or cluster give me "only" data security / availability? Most important for me is not data stored in ES, but abiliti doing querie… --- ## [Two filed in Dashboard](https://discuss.elastic.co/t/two-filed-in-dashboard/268187)
**Author:** [@Arethusa](https://discuss.elastic.co/u/Arethusa)\ **Replies:** 2\ **Last updated:** [March 29, 2021, 1:38pm UTC](https://discuss.elastic.co/t/two-filed-in-dashboard/268187 "2021-03-29T13:38:27Z")
Hello, I am new to Kibana (v7.10.0) but have experience with Graylog. I create widget with "Hostname", but I want add "IP" On "Bucket" I use the field "Hostname". Is it possible to add an other field ? Thank you. --- ## [Kibana Alerts and Actions](https://discuss.elastic.co/t/kibana-alerts-and-actions/268489)
**Author:** [@team\_chefdesk](https://discuss.elastic.co/u/team_chefdesk)\ **Replies:** 1\ **Last updated:** [March 29, 2021, 1:24pm UTC](https://discuss.elastic.co/t/kibana-alerts-and-actions/268489 "2021-03-29T13:24:25Z")
When tried to add simple alerts like uptime status or log threshold, always showing Error found in 1 alert. Not even single alert is working for me, it's not showing what went wrong exactly here... KIBANA LOGS log … --- ## [Searching for event completion](https://discuss.elastic.co/t/searching-for-event-completion/268658)
**Author:** [@ginu](https://discuss.elastic.co/u/ginu)\ **Replies:** 0\ **Last updated:** [March 29, 2021, 1:15pm UTC](https://discuss.elastic.co/t/searching-for-event-completion/268658 "2021-03-29T13:15:17Z")
Hi I have a application which logs everytime it get a file to process with 2021-03-19 10:59:44.8386| INFO|MY App||Starting 2021-03-19 10:59:44.9177| INFO|AppSetting||Exporting to file Appsetting.txt .... .... .... 202… --- ## [AWS Cognito integration with Kibana](https://discuss.elastic.co/t/aws-cognito-integration-with-kibana/268604)
**Author:** [@diwakar\_singh](https://discuss.elastic.co/u/diwakar_singh)\ **Replies:** 2\ **Last updated:** [March 29, 2021, 12:54pm UTC](https://discuss.elastic.co/t/aws-cognito-integration-with-kibana/268604 "2021-03-29T12:54:38Z")
Hi, I'm using AWS Cognito as SSO authentication service for Kibana and my other web application. Everything seems to be working fine but there is one issue. After log in through Cognito, Kibana remains logged in as long… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1485) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1487)