# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1510 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1511 --- ## [ILM change index settings between phases](https://discuss.elastic.co/t/ilm-change-index-settings-between-phases/267128)
**Author:** [@d4nnyx](https://discuss.elastic.co/u/d4nnyx)\ **Replies:** 0\ **Last updated:** [March 12, 2021, 10:42pm UTC](https://discuss.elastic.co/t/ilm-change-index-settings-between-phases/267128 "2021-03-12T22:42:58Z")
Hello, is it possible to change index settings between phases? I have a issue with moving index to warm phase and then shrink with index settings index.routing.allocation.total\_shards\_per\_node = 1. Because of shrink ac… --- ## [This node does not have the remote\_cluster\_client role](https://discuss.elastic.co/t/this-node-does-not-have-the-remote-cluster-client-role/266294)
**Author:** [@dylan0911](https://discuss.elastic.co/u/dylan0911)\ **Replies:** 3\ **Last updated:** [March 12, 2021, 9:01pm UTC](https://discuss.elastic.co/t/this-node-does-not-have-the-remote-cluster-client-role/266294 "2021-03-12T21:01:53Z")
Hi all, Been going through the doc, the topics and github. Can't seem to find an answer tho this one. I have 2 clusters running in 2 different regions and wanted to test CCR. Both of them are running on 7.11.1. I was a… --- ## [Can we use more master nodes instead of 'coordinating only'](https://discuss.elastic.co/t/can-we-use-more-master-nodes-instead-of-coordinating-only/266123)
**Author:** [@NLSVTN](https://discuss.elastic.co/u/NLSVTN)\ **Replies:** 15\ **Last updated:** [March 12, 2021, 8:28pm UTC](https://discuss.elastic.co/t/can-we-use-more-master-nodes-instead-of-coordinating-only/266123 "2021-03-12T20:28:13Z")
Hi, We have an issue that is supposed to be resolved by adding 'coordinating only' nodes: But on AWS (it might be a special case due to the fact that we are using internal company system built on top of AWS for secur… --- ## [Connecting to logstash with Basic Authentication](https://discuss.elastic.co/t/connecting-to-logstash-with-basic-authentication/267121)
**Author:** [@alicango](https://discuss.elastic.co/u/alicango)\ **Replies:** 3\ **Last updated:** [March 12, 2021, 8:28pm UTC](https://discuss.elastic.co/t/connecting-to-logstash-with-basic-authentication/267121 "2021-03-12T20:28:01Z")
Hello, I am using HTTP input plugin in logstash config. I have been always sending data to logstash over HTTP POST method by using logstash API like this; curl -XPOST http://\:9605 -d '{"my": "data"}' also … --- ## ['when not' not working](https://discuss.elastic.co/t/when-not-not-working/267114)
**Author:** [@elbadar](https://discuss.elastic.co/u/elbadar)\ **Replies:** 1\ **Last updated:** [March 12, 2021, 7:08pm UTC](https://discuss.elastic.co/t/when-not-not-working/267114 "2021-03-12T19:08:25Z")
Hi guys, trying to push all log messages that contain 'Failed' or 'ERROR', but doesn't seem to like my syntax. I have looked at the syntax quite a bit but can't seem to nail it down. Didn't find any examples of "when not… --- ## [Problem Posting to Kibana Shared Objects API](https://discuss.elastic.co/t/problem-posting-to-kibana-shared-objects-api/266595)
**Author:** [@brett.b](https://discuss.elastic.co/u/brett.b)\ **Replies:** 3\ **Last updated:** [March 12, 2021, 7:00pm UTC](https://discuss.elastic.co/t/problem-posting-to-kibana-shared-objects-api/266595 "2021-03-12T19:00:38Z")
Hello there - I'm trying to use the Saved Objects "import" feature, but I keep getting 415 response codes. I used the export feature to export a dashboard to a ndjson file and then I try to push that same dashboard back … --- ## [Changed Cluster Name - Licensing Not Working Now](https://discuss.elastic.co/t/changed-cluster-name-licensing-not-working-now/267002)
**Author:** [@brett.b](https://discuss.elastic.co/u/brett.b)\ **Replies:** 2\ **Last updated:** [March 12, 2021, 6:52pm UTC](https://discuss.elastic.co/t/changed-cluster-name-licensing-not-working-now/267002 "2021-03-12T18:52:59Z")
Hello there, I had a cluster which was running fine, but it was called simply "elasticsearch". I wanted to give it a more specific name, so I applied that to my helm chart (elasticsearch-dev) and restarted all of the da… --- ## [Is it possible to interpolate a field's value in a string?](https://discuss.elastic.co/t/is-it-possible-to-interpolate-a-fields-value-in-a-string/267027)
**Author:** [@merricat](https://discuss.elastic.co/u/merricat)\ **Replies:** 1\ **Last updated:** [March 12, 2021, 6:52pm UTC](https://discuss.elastic.co/t/is-it-possible-to-interpolate-a-fields-value-in-a-string/267027 "2021-03-12T18:52:08Z")
Hi there, I've been messing with Filebeat for about 2 days now.. I can't find a way to interpolate a field in another field. Here's what I have: processors: - add\_fields: target: "" fields… --- ## [Elasticsearch 7.11 with 3 nodes](https://discuss.elastic.co/t/elasticsearch-7-11-with-3-nodes/266996)
**Author:** [@b0r1s](https://discuss.elastic.co/u/b0r1s)\ **Replies:** 6\ **Last updated:** [March 12, 2021, 6:46pm UTC](https://discuss.elastic.co/t/elasticsearch-7-11-with-3-nodes/266996 "2021-03-12T18:46:37Z")
Hey everyone o/ I'm trying to setup a cluster with 3 nodes using the elasticsearch.yml file: # ======================== Elasticsearch Configuration ========================= # # NOTE: Elasticsearch comes with reasonabl… --- ## [Reindex getting failed in kibana 6.8.13](https://discuss.elastic.co/t/reindex-getting-failed-in-kibana-6-8-13/266586)
**Author:** [@MdRashid](https://discuss.elastic.co/u/MdRashid)\ **Replies:** 1\ **Last updated:** [March 12, 2021, 6:45pm UTC](https://discuss.elastic.co/t/reindex-getting-failed-in-kibana-6-8-13/266586 "2021-03-12T18:45:32Z")
Hi All I have previous Data of ES v5.0.0 and i upgrade ES v5.0.0 to 6.8.13 after that i start reindex my cluster in kibana it got fail reason dont know.. I want ES to run on v7.6.3. For that i start with ES v6.8.13 My… --- ## [So confused on test prep](https://discuss.elastic.co/t/so-confused-on-test-prep/265997)
**Author:** [@jgearheart](https://discuss.elastic.co/u/jgearheart)\ **Replies:** 1\ **Last updated:** [March 4, 2021, 2:42pm UTC](https://discuss.elastic.co/t/so-confused-on-test-prep/265997 "2021-03-04T14:42:19Z")
I completed Elasticsearch Engineer 1. I want to prepare for the exam by practicing in the lab environment. Since I completed the course already I now cannot access the lab. The training team recommended downloading El… --- ## [Event.get(message).bytesize](https://discuss.elastic.co/t/event-get-message-bytesize/267004)
**Author:** [@jchaves506](https://discuss.elastic.co/u/jchaves506)\ **Replies:** 3\ **Last updated:** [March 12, 2021, 6:07pm UTC](https://discuss.elastic.co/t/event-get-message-bytesize/267004 "2021-03-12T18:07:31Z")
Continuing the discussion from How to get entire enriched "event" size (not message size): I'm using metricbeat, and I'm looking to know what's the size of the message, I tried using that but I'm getting: \[ERROR\]\[logst… --- ## [How to export ELK data from Windows server to AWS cloud](https://discuss.elastic.co/t/how-to-export-elk-data-from-windows-server-to-aws-cloud/267110)
**Author:** [@DENMODSupport](https://discuss.elastic.co/u/DENMODSupport)\ **Replies:** 1\ **Last updated:** [March 12, 2021, 5:07pm UTC](https://discuss.elastic.co/t/how-to-export-elk-data-from-windows-server-to-aws-cloud/267110 "2021-03-12T17:07:47Z")
Hi, We are in the process of migrating our Elastic search from On Prem server to AWS cloud. Could you please help me what could be the best option to export data from On Prem server and import into AWS cloud? --- ## [Kibana after logging with user name and password in going back to login screen](https://discuss.elastic.co/t/kibana-after-logging-with-user-name-and-password-in-going-back-to-login-screen/266641)
**Author:** [@sathish.mtech01](https://discuss.elastic.co/u/sathish.mtech01)\ **Replies:** 4\ **Last updated:** [March 12, 2021, 4:55pm UTC](https://discuss.elastic.co/t/kibana-after-logging-with-user-name-and-password-in-going-back-to-login-screen/266641 "2021-03-12T16:55:46Z")
Kibana after logging with user name and password in going back to login screen itself After inspecting in console there are no errors Deployed in Azure Kubernetes environment --- ## [Rest High Level Client - 6.8.13 - long reindex api call - timeout](https://discuss.elastic.co/t/rest-high-level-client-6-8-13-long-reindex-api-call-timeout/267106)
**Author:** [@LJRamsey](https://discuss.elastic.co/u/LJRamsey)\ **Replies:** 0\ **Last updated:** [March 12, 2021, 4:06pm UTC](https://discuss.elastic.co/t/rest-high-level-client-6-8-13-long-reindex-api-call-timeout/267106 "2021-03-12T16:06:52Z")
Hello, We are upgrading existing application from TransportClient to RestHighLevelClient in 6.8.13 (part of 5.6 to 6.8 upgrade) and facing some issues regarding reindex api and timeout. We are doing index copy throw re… --- ## [Multi series chart in one Visualization on Kibana 7.11](https://discuss.elastic.co/t/multi-series-chart-in-one-visualization-on-kibana-7-11/266796)
**Author:** [@bab](https://discuss.elastic.co/u/bab)\ **Replies:** 4\ **Last updated:** [March 12, 2021, 4:07pm UTC](https://discuss.elastic.co/t/multi-series-chart-in-one-visualization-on-kibana-7-11/266796 "2021-03-12T16:07:53Z")
Hi All, Is it possible to create Multi series chart in a single visualization ? i want to implement a graph like below. any ideas or explanations? Thank you . die Original Data is comming from CSV file --- ## [How can I drop the domain from host.name field in logstash?](https://discuss.elastic.co/t/how-can-i-drop-the-domain-from-host-name-field-in-logstash/267031)
**Author:** [@Ishaan](https://discuss.elastic.co/u/Ishaan)\ **Replies:** 3\ **Last updated:** [March 12, 2021, 4:03pm UTC](https://discuss.elastic.co/t/how-can-i-drop-the-domain-from-host-name-field-in-logstash/267031 "2021-03-12T16:03:48Z")
I want to remove domain from host.name field coming from metricbeat. For example: host.name = abcd.xyz.com host.name = abc@xyz.com I want to remove everything after . or @ or any other delimiter to save the value of … --- ## [Capitalize Every Word In String](https://discuss.elastic.co/t/capitalize-every-word-in-string/266997)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 8\ **Last updated:** [March 12, 2021, 3:56pm UTC](https://discuss.elastic.co/t/capitalize-every-word-in-string/266997 "2021-03-12T15:56:27Z")
Trying to capitalize each word in a fields value. I initially tried the titleize function of Ruby, but that didn't work...I guess because it's not part of Ruby internals or something like that? ruby { code =\> 'ev… --- ## [Applying modified css](https://discuss.elastic.co/t/applying-modified-css/267101)
**Author:** [@hayzjd836](https://discuss.elastic.co/u/hayzjd836)\ **Replies:** 1\ **Last updated:** [March 12, 2021, 3:55pm UTC](https://discuss.elastic.co/t/applying-modified-css/267101 "2021-03-12T15:55:40Z")
Hello! I'm using version 7.11 of kibana I want to hide the elastic logo on the top left of kibana. So I modified the css file of kibana. (/usr/share/kibana/node\_modules/@kbn/ui-shared-deps/target/kbn-ui-shared-deps.v7… --- ## [How do I properly configure input to Logstash for a rewritable file?](https://discuss.elastic.co/t/how-do-i-properly-configure-input-to-logstash-for-a-rewritable-file/267089)
**Author:** [@Andrew\_Foxis](https://discuss.elastic.co/u/Andrew_Foxis)\ **Replies:** 1\ **Last updated:** [March 12, 2021, 3:54pm UTC](https://discuss.elastic.co/t/how-do-i-properly-configure-input-to-logstash-for-a-rewritable-file/267089 "2021-03-12T15:54:32Z")
Hi all! I have csv file, It is overwritten every 5 minutes. I have already configured input, filter,output. But in the current configuration I only get new lines from the file in the index. But I need to have all the… --- ## [Logstash input with filtered output](https://discuss.elastic.co/t/logstash-input-with-filtered-output/266951)
**Author:** [@djehuty](https://discuss.elastic.co/u/djehuty)\ **Replies:** 8\ **Last updated:** [March 12, 2021, 3:48pm UTC](https://discuss.elastic.co/t/logstash-input-with-filtered-output/266951 "2021-03-12T15:48:18Z")
I need to divide Winlogbeat input and push it to two separate indices when a beat has a particular event ID. I used an if statement but the indices seems to have the same data. This is my pipeline configuration: i… --- ## [If(filter,output) Else(filter,output)](https://discuss.elastic.co/t/if-filter-output-else-filter-output/267097)
**Author:** [@aannee](https://discuss.elastic.co/u/aannee)\ **Replies:** 3\ **Last updated:** [March 12, 2021, 3:25pm UTC](https://discuss.elastic.co/t/if-filter-output-else-filter-output/267097 "2021-03-12T15:25:47Z")
Hi Elastic Team, Is this possible in logstash? input { } if "test" in \[mesasge\] { filter {} output {} } else { filter {} output {} } Thank you! --- ## [Can you tune the split\_on\_case\_change setting on the word delimiter token filter?](https://discuss.elastic.co/t/can-you-tune-the-split-on-case-change-setting-on-the-word-delimiter-token-filter/267102)
**Author:** [@peterbe](https://discuss.elastic.co/u/peterbe)\ **Replies:** 0\ **Last updated:** [March 12, 2021, 3:20pm UTC](https://discuss.elastic.co/t/can-you-tune-the-split-on-case-change-setting-on-the-word-delimiter-token-filter/267102 "2021-03-12T15:20:00Z")
I have a love-hate relationship with split\_on\_case\_change My problem is that only certain words make sense to split on case change. For example, I'd like to treat TypedArray as Typed, Array. But I don't want to split up… --- ## [Can I add ingest pipelines to Elasticsearch with a config file as with Logstash?](https://discuss.elastic.co/t/can-i-add-ingest-pipelines-to-elasticsearch-with-a-config-file-as-with-logstash/267098)
**Author:** [@mhare](https://discuss.elastic.co/u/mhare)\ **Replies:** 3\ **Last updated:** [March 12, 2021, 3:10pm UTC](https://discuss.elastic.co/t/can-i-add-ingest-pipelines-to-elasticsearch-with-a-config-file-as-with-logstash/267098 "2021-03-12T15:10:17Z")
Pretty basic question regarding ingest pipelines. I've used Logstash in the past and used pipeline files to create the grok pipelines. I do not see how to do this with Elasticsearch ingest pipelines. I have only been abl… --- ## [WinLogBeat and Windows Server 2019](https://discuss.elastic.co/t/winlogbeat-and-windows-server-2019/265539)
**Author:** [@branden999](https://discuss.elastic.co/u/branden999)\ **Replies:** 5\ **Last updated:** [March 12, 2021, 3:08pm UTC](https://discuss.elastic.co/t/winlogbeat-and-windows-server-2019/265539 "2021-03-12T15:08:15Z")
Having trouble getting WinLogBeat to continue sending logs to Logstash. Prior to last week, I was running a virtual WEC (Windows Event Collector) on Windows Server 2016 with WinLogBeat 6.8 forwarding to a Logstash 6.7.2 … --- ## [Alerting on a specific time range](https://discuss.elastic.co/t/alerting-on-a-specific-time-range/266999)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 4\ **Last updated:** [March 12, 2021, 1:52pm UTC](https://discuss.elastic.co/t/alerting-on-a-specific-time-range/266999 "2021-03-12T13:52:19Z")
Hi is there a way to alert only on a specific time range? lets say office hours.... It is possible? how can I do this? --- ## [Find sequences in time series data](https://discuss.elastic.co/t/find-sequences-in-time-series-data/266965)
**Author:** [@markdturner](https://discuss.elastic.co/u/markdturner)\ **Replies:** 1\ **Last updated:** [March 12, 2021, 1:43pm UTC](https://discuss.elastic.co/t/find-sequences-in-time-series-data/266965 "2021-03-12T13:43:36Z")
Hi, I'm trying to find example queries for returning sequences of events in a time series. My dataset is rainfall values at 10-minute intervals, and I want to find all storm events. A storm event would be considered con… --- ## [Is it recommended to run es aggregations during api calls, how expensive can it be?](https://discuss.elastic.co/t/is-it-recommended-to-run-es-aggregations-during-api-calls-how-expensive-can-it-be/267084)
**Author:** [@manish\_kakoti](https://discuss.elastic.co/u/manish_kakoti)\ **Replies:** 1\ **Last updated:** [March 12, 2021, 1:11pm UTC](https://discuss.elastic.co/t/is-it-recommended-to-run-es-aggregations-during-api-calls-how-expensive-can-it-be/267084 "2021-03-12T13:11:38Z")
there are couple of scenarios that i wanted to discuss: If we run aggregations (on large data sets) during REST API calls? How expensive it is experienced to be? If we store pre-aggregated data(which runs during in… --- ## [Customize dashboard \[Filebeat Nginx\] Overview ECS to point to fbeat-\* instead of filebeat-\* pattern](https://discuss.elastic.co/t/customize-dashboard-filebeat-nginx-overview-ecs-to-point-to-fbeat-instead-of-filebeat-pattern/266906)
**Author:** [@ORich](https://discuss.elastic.co/u/ORich)\ **Replies:** 3\ **Last updated:** [March 12, 2021, 12:41pm UTC](https://discuss.elastic.co/t/customize-dashboard-filebeat-nginx-overview-ecs-to-point-to-fbeat-instead-of-filebeat-pattern/266906 "2021-03-12T12:41:57Z")
Dear experts, could you please tell me the way to customize the amazing dashboards like Filebeat Nginx ECS ones to point to a different index pattern ? By default, it looks like that these dashboards do collect data fr… --- ## [Logstash-tcp-input having unrecoverable error when logstash is used in systemd](https://discuss.elastic.co/t/logstash-tcp-input-having-unrecoverable-error-when-logstash-is-used-in-systemd/267079)
**Author:** [@Arvind\_Ks](https://discuss.elastic.co/u/Arvind_Ks)\ **Replies:** 0\ **Last updated:** [March 12, 2021, 11:53am UTC](https://discuss.elastic.co/t/logstash-tcp-input-having-unrecoverable-error-when-logstash-is-used-in-systemd/267079 "2021-03-12T11:53:53Z")
Hi Team, I am trying to use tcp plugin in logstash. When i run the config file related to this using logstash cli command , i am able to start it without any issues. However when i try starting it as a systemd service i… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1509) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1511)