# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1506 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1507 --- ## [Cross-cluster search on-premise remote cluster from Elastic Cloud Deployment](https://discuss.elastic.co/t/cross-cluster-search-on-premise-remote-cluster-from-elastic-cloud-deployment/267273)
**Author:** [@cvanhalt](https://discuss.elastic.co/u/cvanhalt)\ **Replies:** 2\ **Last updated:** [March 16, 2021, 4:06pm UTC](https://discuss.elastic.co/t/cross-cluster-search-on-premise-remote-cluster-from-elastic-cloud-deployment/267273 "2021-03-16T16:06:06Z")
Is it possible to use the cross-cluster search feature to query a Elastic Cloud Deployment in Azure and an on-premise remote Cluster? Both with the Basic/Standard License. Connection should be made through a VPN. I'm … --- ## [Retry Logstash connection to a DB after failed attempt](https://discuss.elastic.co/t/retry-logstash-connection-to-a-db-after-failed-attempt/266441)
**Author:** [@d.malacrida](https://discuss.elastic.co/u/d.malacrida)\ **Replies:** 4\ **Last updated:** [March 16, 2021, 4:30pm UTC](https://discuss.elastic.co/t/retry-logstash-connection-to-a-db-after-failed-attempt/266441 "2021-03-16T16:30:09Z")
Hello everyone, We have set up a Logstash connector to gather data from a DB every day at a fixed time (7 a.m.). Now, we have included the following parameters in the input.conf file (some parameters are masked for obvi… --- ## [LOGSTASH : output pipe](https://discuss.elastic.co/t/logstash-output-pipe/267390)
**Author:** [@Alex\_Lum](https://discuss.elastic.co/u/Alex_Lum)\ **Replies:** 2\ **Last updated:** [March 16, 2021, 4:24pm UTC](https://discuss.elastic.co/t/logstash-output-pipe/267390 "2021-03-16T16:24:10Z")
Hello there, I have a winlogbeat which send datas on logstash. On logstash : input beat, some filters and output to elasticSearch. But i want to output SOME fields on a named pipe (mkfifo) to insert them on a MariaDB. … --- ## [Delete or update document without document\_id](https://discuss.elastic.co/t/delete-or-update-document-without-document-id/267375)
**Author:** [@lele15](https://discuss.elastic.co/u/lele15)\ **Replies:** 5\ **Last updated:** [March 16, 2021, 4:18pm UTC](https://discuss.elastic.co/t/delete-or-update-document-without-document-id/267375 "2021-03-16T16:18:25Z")
Hi, i'm new on ES, i'am using logstash and csv to update or delete values into ES. I want to delete or update document based on different field not only with document\_id like this: input { stdin{} } filter { csv … --- ## [How to create periodic check in logstash](https://discuss.elastic.co/t/how-to-create-periodic-check-in-logstash/267342)
**Author:** [@anupts](https://discuss.elastic.co/u/anupts)\ **Replies:** 1\ **Last updated:** [March 16, 2021, 3:59pm UTC](https://discuss.elastic.co/t/how-to-create-periodic-check-in-logstash/267342 "2021-03-16T15:59:45Z")
Hello, We have requirement , where we need to monitor for user activity on periodic basis. We will have this information in our log file . FOr example: User has accessed some page in the application. This will be log… --- ## [Primary store size showing wrong info while using \_cat/indices](https://discuss.elastic.co/t/primary-store-size-showing-wrong-info-while-using-cat-indices/267361)
**Author:** [@Divit\_Sharma](https://discuss.elastic.co/u/Divit_Sharma)\ **Replies:** 6\ **Last updated:** [March 16, 2021, 3:41pm UTC](https://discuss.elastic.co/t/primary-store-size-showing-wrong-info-while-using-cat-indices/267361 "2021-03-16T15:41:02Z")
I somehow doubt \_cat/indices is showing me wrong information regarding store size. I have two indices - giitran\_with\_message and giitran\_without\_message. Now both have have almost the same document. Each one has 1000 … --- ## [Export and Import Index Patterns using elasticdump in ELK ver 7](https://discuss.elastic.co/t/export-and-import-index-patterns-using-elasticdump-in-elk-ver-7/267302)
**Author:** [@nguyenduyhung1979](https://discuss.elastic.co/u/nguyenduyhung1979)\ **Replies:** 13\ **Last updated:** [March 16, 2021, 3:16pm UTC](https://discuss.elastic.co/t/export-and-import-index-patterns-using-elasticdump-in-elk-ver-7/267302 "2021-03-16T15:16:26Z")
I try setup automation system which has the workflow: Have server where ELK stack has been installed and has basic configuration Import the index into ElasticSearch (ES), next Kibana can use that index for Visualize F… --- ## [How you deal with ILM for kubernetes cluster applications?](https://discuss.elastic.co/t/how-you-deal-with-ilm-for-kubernetes-cluster-applications/267391)
**Author:** [@Kosodrom](https://discuss.elastic.co/u/Kosodrom)\ **Replies:** 0\ **Last updated:** [March 16, 2021, 3:08pm UTC](https://discuss.elastic.co/t/how-you-deal-with-ilm-for-kubernetes-cluster-applications/267391 "2021-03-16T15:08:33Z")
Hi, I am collecting logs from kubernetes cluster using filebeat, which is deployed as daemonset I ship logs using logstash to my elasticsearch cluster in one index I am using ILM for controlling the retention time for … --- ## [Split/explode strings](https://discuss.elastic.co/t/split-explode-strings/267369)
**Author:** [@cibernicola](https://discuss.elastic.co/u/cibernicola)\ **Replies:** 2\ **Last updated:** [March 16, 2021, 2:56pm UTC](https://discuss.elastic.co/t/split-explode-strings/267369 "2021-03-16T14:56:03Z")
Hi, I have several text strings with separator patterns that I would like to be able to ingest as objects in elasticsearch, these strings are of the style: (a) text|text b) number text|number text c) mailto:text@text … --- ## [CCR between 2 Elastic clusters in different K8s clusters](https://discuss.elastic.co/t/ccr-between-2-elastic-clusters-in-different-k8s-clusters/267287)
**Author:** [@jcobb48](https://discuss.elastic.co/u/jcobb48)\ **Replies:** 0\ **Last updated:** [March 15, 2021, 4:11pm UTC](https://discuss.elastic.co/t/ccr-between-2-elastic-clusters-in-different-k8s-clusters/267287 "2021-03-15T16:11:39Z")
Hi everyone, wanted to get some advice to implement cross-cluster replication between 2 Elasticsearch clusters that are deployed in different Kubernetes clusters. Both ES clusters are healthy and running with version 6.… --- ## [Configure Input and Modules at the same time for Filebeat](https://discuss.elastic.co/t/configure-input-and-modules-at-the-same-time-for-filebeat/266575)
**Author:** [@Kosodrom](https://discuss.elastic.co/u/Kosodrom)\ **Replies:** 4\ **Last updated:** [March 16, 2021, 2:37pm UTC](https://discuss.elastic.co/t/configure-input-and-modules-at-the-same-time-for-filebeat/266575 "2021-03-16T14:37:53Z")
Hi, I have following scenario: One filebeat installation to collect icinga logs. For this I am using icinga module On the same host I have another application's logs, which are located in different path and have d… --- ## [Data Reports not working without change](https://discuss.elastic.co/t/data-reports-not-working-without-change/265976)
**Author:** [@Atul\_Chadha](https://discuss.elastic.co/u/Atul_Chadha)\ **Replies:** 2\ **Last updated:** [March 16, 2021, 2:10pm UTC](https://discuss.elastic.co/t/data-reports-not-working-without-change/265976 "2021-03-16T14:10:46Z")
One of the environments on 7.6 has stopped reporting total number of hosts on a fixed pattern without any change. It was working fine before the weekend The data for the index pattern is coming in fine and i am able t… --- ## [Create keystore and keys with ansible](https://discuss.elastic.co/t/create-keystore-and-keys-with-ansible/267381)
**Author:** [@Soren\_vdc](https://discuss.elastic.co/u/Soren_vdc)\ **Replies:** 0\ **Last updated:** [March 16, 2021, 1:54pm UTC](https://discuss.elastic.co/t/create-keystore-and-keys-with-ansible/267381 "2021-03-16T13:54:58Z")
Hi, I want to create ansible code to secure the password of the logstash user to send data to Elasticsearch. I have checked with the procedure with the keystore and it works fine to create the keystore but to add the ke… --- ## [Plugin questions](https://discuss.elastic.co/t/plugin-questions/267378)
**Author:** [@nmalocic](https://discuss.elastic.co/u/nmalocic)\ **Replies:** 0\ **Last updated:** [March 16, 2021, 1:37pm UTC](https://discuss.elastic.co/t/plugin-questions/267378 "2021-03-16T13:37:01Z")
Hi everyone, I have few questions related to plugins. Is it possible to log actions inside my processor plugin? What is the best way to ensure all existing documents are processed with new plugin and processor that us… --- ## [How to check if the data is coming in last 30 min](https://discuss.elastic.co/t/how-to-check-if-the-data-is-coming-in-last-30-min/267341)
**Author:** [@jyothsna](https://discuss.elastic.co/u/jyothsna)\ **Replies:** 2\ **Last updated:** [March 16, 2021, 1:10pm UTC](https://discuss.elastic.co/t/how-to-check-if-the-data-is-coming-in-last-30-min/267341 "2021-03-16T13:10:26Z")
Hi, I am ingesting data from sql to elastic through logstash. Now I want to check whether the data is coming or not in last30 min .if not coming so that i can trap as missing data in elasticsearch. how to achieve this. … --- ## [Disable adding filter upon click on a bar chart](https://discuss.elastic.co/t/disable-adding-filter-upon-click-on-a-bar-chart/267350)
**Author:** [@kasun](https://discuss.elastic.co/u/kasun)\ **Replies:** 3\ **Last updated:** [March 16, 2021, 12:47pm UTC](https://discuss.elastic.co/t/disable-adding-filter-upon-click-on-a-bar-chart/267350 "2021-03-16T12:47:40Z")
Hi all, In above chart when I click on bars it will automatically add a filter to the entire dashboard. As an example when I click on the first bar it will add a filter as in below. Is there a way to disable this … --- ## [Colors in Elastic Detections Alert Emails](https://discuss.elastic.co/t/colors-in-elastic-detections-alert-emails/267155)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 3\ **Last updated:** [March 16, 2021, 12:05pm UTC](https://discuss.elastic.co/t/colors-in-elastic-detections-alert-emails/267155 "2021-03-16T12:05:59Z")
Hello, Can we use colors in Elastic Detections Alert Emails? Willem --- ## [Bad dates in names after rolling with ILM](https://discuss.elastic.co/t/bad-dates-in-names-after-rolling-with-ilm/267270)
**Author:** [@Jiri\_Petak](https://discuss.elastic.co/u/Jiri_Petak)\ **Replies:** 1\ **Last updated:** [March 16, 2021, 11:55am UTC](https://discuss.elastic.co/t/bad-dates-in-names-after-rolling-with-ilm/267270 "2021-03-16T11:55:30Z")
Hi, i am working on Elasticsearch version 7.7.0 with logstash and creating indices with ILM and rolling index aliases. I have defined ILM like: { "weekly\_rollover-4w\_retention" : { "version" : 2, … --- ## [Configure SSL/TLS beats for Windows](https://discuss.elastic.co/t/configure-ssl-tls-beats-for-windows/267346)
**Author:** [@ravenmx](https://discuss.elastic.co/u/ravenmx)\ **Replies:** 1\ **Last updated:** [March 16, 2021, 11:45am UTC](https://discuss.elastic.co/t/configure-ssl-tls-beats-for-windows/267346 "2021-03-16T11:45:21Z")
Hello. I can not configure metricbeat for Windows. It is required to configure ssl / tsl connection before logstash. but the agent does not accept system paths (C: \\ path \\ to \\ beats \\ sslCA.pem). therefore I can not sp… --- ## [Using the heartbeat (6.8.3) keystore prevents heartbeat windows service starting](https://discuss.elastic.co/t/using-the-heartbeat-6-8-3-keystore-prevents-heartbeat-windows-service-starting/267353)
**Author:** [@halltony](https://discuss.elastic.co/u/halltony)\ **Replies:** 0\ **Last updated:** [March 16, 2021, 11:06am UTC](https://discuss.elastic.co/t/using-the-heartbeat-6-8-3-keystore-prevents-heartbeat-windows-service-starting/267353 "2021-03-16T11:06:45Z")
I am trying to use the heartbeat keystore to store credentials used to authenticate with my Elastic Search cluster. The configuration works fine when run from a command line but when I use it via a windows service the s… --- ## [Show date with correct timezone in Kibana alert emails](https://discuss.elastic.co/t/show-date-with-correct-timezone-in-kibana-alert-emails/267159)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 2\ **Last updated:** [March 16, 2021, 10:58am UTC](https://discuss.elastic.co/t/show-date-with-correct-timezone-in-kibana-alert-emails/267159 "2021-03-16T10:58:10Z")
Hello, In Elastic SIEM alert emails, we can use {{date}} as date in email alerts. But the problem is that date is in GMT and my timezone is GMT+1. Is there a way to be able to show the correct date in Kibana alert email… --- ## [Process Rejection Question](https://discuss.elastic.co/t/process-rejection-question/267325)
**Author:** [@nyquillus](https://discuss.elastic.co/u/nyquillus)\ **Replies:** 4\ **Last updated:** [March 16, 2021, 10:52am UTC](https://discuss.elastic.co/t/process-rejection-question/267325 "2021-03-16T10:52:36Z")
Hi, we're operating an ELK cluster on a single host. The current setup includes: 3 node ( 1 master-nodata, 2 master-data) containers 2 logstash containers (for app and for container logs) 2 kibana containers(1 for adm… --- ## [Rollup: Deleted index but cannot stop/delete job](https://discuss.elastic.co/t/rollup-deleted-index-but-cannot-stop-delete-job/265930)
**Author:** [@tg295](https://discuss.elastic.co/u/tg295)\ **Replies:** 3\ **Last updated:** [March 16, 2021, 10:48am UTC](https://discuss.elastic.co/t/rollup-deleted-index-but-cannot-stop-delete-job/265930 "2021-03-16T10:48:06Z")
I have a rollup job in state "Indexing". I cannot stop nor delete the job - stopping is not an option and deleting brings up the following error: 400: Bad Request. Could not delete job \[index-blah\] because indexer state… --- ## [Filter in Kibana Visualization on values with spaces in it](https://discuss.elastic.co/t/filter-in-kibana-visualization-on-values-with-spaces-in-it/267288)
**Author:** [@Philbert](https://discuss.elastic.co/u/Philbert)\ **Replies:** 2\ **Last updated:** [March 16, 2021, 10:36am UTC](https://discuss.elastic.co/t/filter-in-kibana-visualization-on-values-with-spaces-in-it/267288 "2021-03-16T10:36:59Z")
We use Kibana to analyse the HTTP logs of on our CDN. One important field is the user agent. From the user agent I can see which device was requesting an HTTP request from the CDN. I would like to gather statistics on … --- ## [Logstash](https://discuss.elastic.co/t/logstash/267348)
**Author:** [@alipujaistopo](https://discuss.elastic.co/u/alipujaistopo)\ **Replies:** 0\ **Last updated:** [March 16, 2021, 10:35am UTC](https://discuss.elastic.co/t/logstash/267348 "2021-03-16T10:35:52Z")
why my logstash don't send log to elastic? I have made a logstash's ip and elasticsearch's ip at /etc/hosts in logstash's server and i made a "output-elasticsearch.conf" at /etc/logstash/conf.d in logstash's server w… --- ## [Elasticsearch security use ldap how to config role](https://discuss.elastic.co/t/elasticsearch-security-use-ldap-how-to-config-role/267347)
**Author:** [@taoyantu](https://discuss.elastic.co/u/taoyantu)\ **Replies:** 0\ **Last updated:** [March 16, 2021, 10:30am UTC](https://discuss.elastic.co/t/elasticsearch-security-use-ldap-how-to-config-role/267347 "2021-03-16T10:30:18Z")
hello master ,please help me ,i use the elasticsearch realms ldap ,the elasticsearch.yml like realms: ldap: ldap1: follow\_referrals:false order: 10 url: "xxxxx" bind\_dn: "xxxx" bind\_pasword: "xxxx" user\_search: … --- ## [Problem adding company certificate in Elasticsearch](https://discuss.elastic.co/t/problem-adding-company-certificate-in-elasticsearch/267344)
**Author:** [@Andrea92](https://discuss.elastic.co/u/Andrea92)\ **Replies:** 0\ **Last updated:** [March 16, 2021, 9:46am UTC](https://discuss.elastic.co/t/problem-adding-company-certificate-in-elasticsearch/267344 "2021-03-16T09:46:14Z")
Buenos días a tod@s, Tengo un problema con el certificado de mi empresa. Cuando le incorporo la ruta a las variables de docker de Elasticsearch para que los lea y los compruebe pero me dice que el certificado de interca… --- ## [Creating a transform with must\_not bool not working as expected](https://discuss.elastic.co/t/creating-a-transform-with-must-not-bool-not-working-as-expected/267330)
**Author:** [@vigneshr35](https://discuss.elastic.co/u/vigneshr35)\ **Replies:** 1\ **Last updated:** [March 16, 2021, 9:26am UTC](https://discuss.elastic.co/t/creating-a-transform-with-must-not-bool-not-working-as-expected/267330 "2021-03-16T09:26:32Z")
Hi everyone, I am trying to create a transform and facing some issues with using the must\_not for a specific condition I have. Here are the details: Source index sample document: { "app.status": "COMPLETED", "@ti… --- ## [Received plaintext http traffic on an https channel, closing connection Netty4HttpChannel](https://discuss.elastic.co/t/received-plaintext-http-traffic-on-an-https-channel-closing-connection-netty4httpchannel/266957)
**Author:** [@Andrea92](https://discuss.elastic.co/u/Andrea92)\ **Replies:** 9\ **Last updated:** [March 16, 2021, 9:26am UTC](https://discuss.elastic.co/t/received-plaintext-http-traffic-on-an-https-channel-closing-connection-netty4httpchannel/266957 "2021-03-16T09:26:04Z")
Buenas tardes, Soy nueva en estos foros, pero he visto que la mayoría de los problemas que me he encontrado con ELK los he podido solucionar gracias a este foro. Pero este problema lo llevo arrastrando ya más de 1 mes … --- ## [High CPU (cgroup) usage/utilization](https://discuss.elastic.co/t/high-cpu-cgroup-usage-utilization/258964)
**Author:** [@NejcK](https://discuss.elastic.co/u/NejcK)\ **Replies:** 19\ **Last updated:** [March 16, 2021, 8:34am UTC](https://discuss.elastic.co/t/high-cpu-cgroup-usage-utilization/258964 "2021-03-16T08:34:09Z")
Hi. We have only one node in our cluster (hosted on Elastic cloud, v7.10.0) with Kibana (for filebeat and metricbeat) and everything was working fine until about last week. I'm pretty new to all this, but I've set up al… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1505) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1507)