# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1515 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1516 --- ## [Changing Logo of Elastic Search](https://discuss.elastic.co/t/changing-logo-of-elastic-search/266690)
**Author:** [@mohammadawaisjavaid](https://discuss.elastic.co/u/mohammadawaisjavaid)\ **Replies:** 1\ **Last updated:** [March 10, 2021, 9:51am UTC](https://discuss.elastic.co/t/changing-logo-of-elastic-search/266690 "2021-03-10T09:51:23Z")
Hi All, I am using Stack Management 7.10.2 and I want to replace the logo of elastic search at every level with my own logo. I have noticed that the logo appearing is being fetched from logoElastic class or variable. Pl… --- ## [Snapshot recovery problem](https://discuss.elastic.co/t/snapshot-recovery-problem/266782)
**Author:** [@haipeng.zhao](https://discuss.elastic.co/u/haipeng.zhao)\ **Replies:** 0\ **Last updated:** [March 10, 2021, 9:03am UTC](https://discuss.elastic.co/t/snapshot-recovery-problem/266782 "2021-03-10T09:03:11Z")
hi all POST /\_snapshot/my\_backup/snapshot\_1/\_restore { "indices": "data\_stream\_1,index\_1,index\_2", "ignore\_unavailable": true, "include\_global\_state": false, "rename\_pattern": "index\_(.+)", "rena… --- ## [Kibana keeps showing old logs on the discover tab after applying a lifecycle policy with index template](https://discuss.elastic.co/t/kibana-keeps-showing-old-logs-on-the-discover-tab-after-applying-a-lifecycle-policy-with-index-template/265791)
**Author:** [@K\_Shayeb](https://discuss.elastic.co/u/K_Shayeb)\ **Replies:** 7\ **Last updated:** [March 10, 2021, 8:38am UTC](https://discuss.elastic.co/t/kibana-keeps-showing-old-logs-on-the-discover-tab-after-applying-a-lifecycle-policy-with-index-template/265791 "2021-03-10T08:38:33Z")
Description I'm using fluentd to send logs to Elasticsearch 7.10.0 / Kibana 7.10.0 Now without applying any IndexTemplate and LifecyclePolicy I face no issues. However, After applying an IndexTemplate and LifecyclePolic… --- ## [Performance of outside Query vs filter inside aggregation while aggregating](https://discuss.elastic.co/t/performance-of-outside-query-vs-filter-inside-aggregation-while-aggregating/266726)
**Author:** [@the\_nemo](https://discuss.elastic.co/u/the_nemo)\ **Replies:** 3\ **Last updated:** [March 10, 2021, 8:24am UTC](https://discuss.elastic.co/t/performance-of-outside-query-vs-filter-inside-aggregation-while-aggregating/266726 "2021-03-10T08:24:16Z")
Is there any performance difference between the below two quires assuming "type" is a keyword? { "size": 0, "aggs": { "t\_shirts": { "filter": { "term": { "type… --- ## [Metricbeat 7.10.2 on Win 10: First 10 minutes not logging](https://discuss.elastic.co/t/metricbeat-7-10-2-on-win-10-first-10-minutes-not-logging/266662)
**Author:** [@Jaroslav](https://discuss.elastic.co/u/Jaroslav)\ **Replies:** 2\ **Last updated:** [March 10, 2021, 7:45am UTC](https://discuss.elastic.co/t/metricbeat-7-10-2-on-win-10-first-10-minutes-not-logging/266662 "2021-03-10T07:45:54Z")
Hello guys, I am running Metricbeat on Windows and observed that first 10 minutes of system events after service restart is not logged anywhere. Is it bug or a feature? Even when I switch to queue.disk, the first data i… --- ## [Ingest Node](https://discuss.elastic.co/t/ingest-node/266763)
**Author:** [@Changra](https://discuss.elastic.co/u/Changra)\ **Replies:** 3\ **Last updated:** [March 10, 2021, 7:08am UTC](https://discuss.elastic.co/t/ingest-node/266763 "2021-03-10T07:08:21Z")
I added the ingest pipeline with the name "transfer-pipeline" in the logstash output as below, output { if "mm" in \[service\_name\] { elasticsearch { ssl =\> true ssl\_certificate\_verification =\> true ilm\_rollover\_ali… --- ## [How to store real estate data in an elastic search?](https://discuss.elastic.co/t/how-to-store-real-estate-data-in-an-elastic-search/266747)
**Author:** [@jay2021](https://discuss.elastic.co/u/jay2021)\ **Replies:** 1\ **Last updated:** [March 9, 2021, 11:49pm UTC](https://discuss.elastic.co/t/how-to-store-real-estate-data-in-an-elastic-search/266747 "2021-03-09T23:49:54Z")
I have Real Estate data. I am looking into storing it into elastic search to allow users to search the database real time. I want to be able to let my users search by key fields like price, lot size, year-built, total b… --- ## [Add 3 master nodes to our cluster configured only default(master/data...) node](https://discuss.elastic.co/t/add-3-master-nodes-to-our-cluster-configured-only-default-master-data-node/266764)
**Author:** [@mgjung02](https://discuss.elastic.co/u/mgjung02)\ **Replies:** 0\ **Last updated:** [March 10, 2021, 5:39am UTC](https://discuss.elastic.co/t/add-3-master-nodes-to-our-cluster-configured-only-default-master-data-node/266764 "2021-03-10T05:39:59Z")
Now, we run 6 nodes and all of them has default role (master/data...). For more efficient cluster environment, we want to change our cluster like below. Add 2 master-dedicated node. (new node) Change one existed n… --- ## [Every line of Logs is not passing through](https://discuss.elastic.co/t/every-line-of-logs-is-not-passing-through/266698)
**Author:** [@Saravana37](https://discuss.elastic.co/u/Saravana37)\ **Replies:** 2\ **Last updated:** [March 10, 2021, 5:25am UTC](https://discuss.elastic.co/t/every-line-of-logs-is-not-passing-through/266698 "2021-03-10T05:25:29Z")
Hello All , I have below sample line in from the log file which is not passing through logstash. I am not sure where the problem is , I have the below log line 2021-02-24 10:46:29,827 INFO \[5b5021c6-6af1-4e70-9cfb-f0… --- ## [I downloaded and installed elasticsearch](https://discuss.elastic.co/t/i-downloaded-and-installed-elasticsearch/266760)
**Author:** [@PaulGureghian](https://discuss.elastic.co/u/PaulGureghian)\ **Replies:** 1\ **Last updated:** [March 10, 2021, 4:41am UTC](https://discuss.elastic.co/t/i-downloaded-and-installed-elasticsearch/266760 "2021-03-10T04:41:32Z")
But when I do ./bin/elasticsearch it says it can't find the bundled jdk. Why do I have to set JAVA\_HOME for Elasticsearch to use it's bundled Java? And if I have to set JAVA\_HOME, what exactly do I need to do ? What … --- ## [Referencing values from multiple elements](https://discuss.elastic.co/t/referencing-values-from-multiple-elements/266756)
**Author:** [@tangkalo](https://discuss.elastic.co/u/tangkalo)\ **Replies:** 4\ **Last updated:** [March 10, 2021, 4:26am UTC](https://discuss.elastic.co/t/referencing-values-from-multiple-elements/266756 "2021-03-10T04:26:57Z")
Hi, is it possible to reference column values from two different datatables. What I would like to do is to use the values from the separate tables to calculate a new value and then use it in a separate element. If not, i… --- ## [/\_template OR /\_index\_template?](https://discuss.elastic.co/t/template-or-index-template/266567)
**Author:** [@thesn](https://discuss.elastic.co/u/thesn)\ **Replies:** 4\ **Last updated:** [March 10, 2021, 4:20am UTC](https://discuss.elastic.co/t/template-or-index-template/266567 "2021-03-10T04:20:09Z")
Hi, I am using ES 7.11.1 and Logstash 7.11.1 in Docker container. here is my logstash.conf: input { file { codec =\> "json" path =\> "/usr/share/logstash/config/sample.log" } } filter { } output { el… --- ## [How to use port 443 to access Kibana](https://discuss.elastic.co/t/how-to-use-port-443-to-access-kibana/266757)
**Author:** [@AClerk](https://discuss.elastic.co/u/AClerk)\ **Replies:** 1\ **Last updated:** [March 10, 2021, 2:57am UTC](https://discuss.elastic.co/t/how-to-use-port-443-to-access-kibana/266757 "2021-03-10T02:57:56Z")
Hi, I think this is basic. How can I use port 443? Changing the kibana.yml itself is not enough?! Any other configurations on the OS level? Or something else? Currently, I can access with HTTPS but with port 5601 on… --- ## [Using TLS with PFX from third party in 7.11](https://discuss.elastic.co/t/using-tls-with-pfx-from-third-party-in-7-11/266743)
**Author:** [@ARDiver86](https://discuss.elastic.co/u/ARDiver86)\ **Replies:** 1\ **Last updated:** [March 10, 2021, 2:46am UTC](https://discuss.elastic.co/t/using-tls-with-pfx-from-third-party-in-7-11/266743 "2021-03-10T02:46:42Z")
I am having issues getting TLS working on my two-node cluster. I know two-node is not best practice or supported in Elastic or any other clustering technology, but this is just test environment that I will add more nodes… --- ## [Strange error - 'provisioner-\*' index pattern doesn't have a scripted field called 'kubernetes.labels.eks\_amazonaws\_com'](https://discuss.elastic.co/t/strange-error-provisioner-index-pattern-doesnt-have-a-scripted-field-called-kubernetes-labels-eks-amazonaws-com/266621)
**Author:** [@pingz](https://discuss.elastic.co/u/pingz)\ **Replies:** 0\ **Last updated:** [March 9, 2021, 12:13am UTC](https://discuss.elastic.co/t/strange-error-provisioner-index-pattern-doesnt-have-a-scripted-field-called-kubernetes-labels-eks-amazonaws-com/266621 "2021-03-09T00:13:52Z")
I have an elastic index pattern named "provisoner-\*" that contains field "kubernetes.labels.eks\_amazonaws\_com/component" I noticed that whenever I tried to edit a field that contains character '/', in Kinana index patter… --- ## [How to automatically delete documents older than 3 months](https://discuss.elastic.co/t/how-to-automatically-delete-documents-older-than-3-months/265851)
**Author:** [@kate\_yxy](https://discuss.elastic.co/u/kate_yxy)\ **Replies:** 7\ **Last updated:** [March 9, 2021, 10:22pm UTC](https://discuss.elastic.co/t/how-to-automatically-delete-documents-older-than-3-months/265851 "2021-03-09T22:22:06Z")
Hey, I want to delete documents older than 3 months in my index. And I have read the doc here about using ILM to create time-based indices and apply ILM policies. However, this doesn't seem to fit our use case. We're us… --- ## [I downloaded and installed elasticsearch](https://discuss.elastic.co/t/i-downloaded-and-installed-elasticsearch/266623)
**Author:** [@PaulGureghian](https://discuss.elastic.co/u/PaulGureghian)\ **Replies:** 4\ **Last updated:** [March 9, 2021, 10:21pm UTC](https://discuss.elastic.co/t/i-downloaded-and-installed-elasticsearch/266623 "2021-03-09T22:21:54Z")
\*\*On Linux Mint. I extracted the archive tar.gz and cd into elasticsearch dir and ran ./bin/elasticsearch, \*\* The error message was: could not find java in the bundled jdk dir. I have Open JDK already installed on my s… --- ## [Snapshot and restore users, spaces and aliases](https://discuss.elastic.co/t/snapshot-and-restore-users-spaces-and-aliases/264200)
**Author:** [@martinsz](https://discuss.elastic.co/u/martinsz)\ **Replies:** 2\ **Last updated:** [March 9, 2021, 9:34pm UTC](https://discuss.elastic.co/t/snapshot-and-restore-users-spaces-and-aliases/264200 "2021-03-09T21:34:53Z")
Hello, we are finally moving ahead with STIRing our data (earlier post for context https://discuss.elastic.co/t/help-a-non-profit-stir-the-data/251589 ) And we have now found challenges while moving data to the main clus… --- ## [REST API for setting default landing page and index pattern for a space](https://discuss.elastic.co/t/rest-api-for-setting-default-landing-page-and-index-pattern-for-a-space/266412)
**Author:** [@umesh2020](https://discuss.elastic.co/u/umesh2020)\ **Replies:** 6\ **Last updated:** [March 9, 2021, 8:45pm UTC](https://discuss.elastic.co/t/rest-api-for-setting-default-landing-page-and-index-pattern-for-a-space/266412 "2021-03-09T20:45:24Z")
Hi Is there a REST API for setting the default landing page and index pattern for a space ? I want to programatically create a space and set these attributes. Thanks Umesha --- ## ["enabing" security on an existing multinode cluster with multiple clients](https://discuss.elastic.co/t/enabing-security-on-an-existing-multinode-cluster-with-multiple-clients/266753)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 0\ **Last updated:** [March 9, 2021, 8:19pm UTC](https://discuss.elastic.co/t/enabing-security-on-an-existing-multinode-cluster-with-multiple-clients/266753 "2021-03-09T20:19:41Z")
I am trying to plan how to "enable security" on my cluster with the minimum of disruption to data collection. Most of the documentation focuses on how to do this when starting up a new installation (unsurprisingly). In… --- ## [Increase elasticsearch version when importing resthighlevelclient](https://discuss.elastic.co/t/increase-elasticsearch-version-when-importing-resthighlevelclient/266735)
**Author:** [@Carlos\_Fernando\_Palm](https://discuss.elastic.co/u/Carlos_Fernando_Palm)\ **Replies:** 2\ **Last updated:** [March 9, 2021, 8:14pm UTC](https://discuss.elastic.co/t/increase-elasticsearch-version-when-importing-resthighlevelclient/266735 "2021-03-09T20:14:32Z")
Hello people. I am using resthighlevelclient to connect to elasticsearch 7.9.3. Now I have done by importing all of this: \ \org.elasticsearch.client\ \ela… --- ## [How to limit the Relate search terms suggestion](https://discuss.elastic.co/t/how-to-limit-the-relate-search-terms-suggestion/266752)
**Author:** [@RKSKirpalani](https://discuss.elastic.co/u/RKSKirpalani)\ **Replies:** 0\ **Last updated:** [March 9, 2021, 8:14pm UTC](https://discuss.elastic.co/t/how-to-limit-the-relate-search-terms-suggestion/266752 "2021-03-09T20:14:11Z")
I use ES 6.5 in my Magento 2.3 website, when i search anything on my website, The search terms are appearing many line that full my mobile view website. how i can limit this to 2 suggestion. with regards, R.Sahu --- ## [Ingest pipeline script field math](https://discuss.elastic.co/t/ingest-pipeline-script-field-math/265136)
**Author:** [@gentle\_ghost](https://discuss.elastic.co/u/gentle_ghost)\ **Replies:** 6\ **Last updated:** [March 9, 2021, 7:54pm UTC](https://discuss.elastic.co/t/ingest-pipeline-script-field-math/265136 "2021-03-09T19:54:48Z")
Hello, I'm trying to create a ingest processor pipeline in kibana and could use some help. I'm trying to divide 2 values by each other which is the problem. Value 1 is an integer and Value 2 is a string. I'd like to … --- ## [Stop exporting logs after file reaches a certain size](https://discuss.elastic.co/t/stop-exporting-logs-after-file-reaches-a-certain-size/266652)
**Author:** [@agushchin](https://discuss.elastic.co/u/agushchin)\ **Replies:** 1\ **Last updated:** [March 9, 2021, 7:49pm UTC](https://discuss.elastic.co/t/stop-exporting-logs-after-file-reaches-a-certain-size/266652 "2021-03-09T19:49:03Z")
Hi, I have the following question/problem: is there a way to stop exporting/propagating logs (either by filebeat or logstash) after the log file reaches a certain size limit? Asking because recently faced an issue caused… --- ## [Filebeat and IIS W3C dynamic headers support](https://discuss.elastic.co/t/filebeat-and-iis-w3c-dynamic-headers-support/265519)
**Author:** [@BkQc](https://discuss.elastic.co/u/BkQc)\ **Replies:** 1\ **Last updated:** [March 9, 2021, 7:25pm UTC](https://discuss.elastic.co/t/filebeat-and-iis-w3c-dynamic-headers-support/265519 "2021-03-09T19:25:45Z")
Is there any existing module that is enable to automatically account for fields definition in the W3C logs? If not, would it be possible to consider developping one? I know there already is an IIS module but it is based … --- ## [KV Filter Regex](https://discuss.elastic.co/t/kv-filter-regex/266730)
**Author:** [@lumi](https://discuss.elastic.co/u/lumi)\ **Replies:** 1\ **Last updated:** [March 9, 2021, 6:13pm UTC](https://discuss.elastic.co/t/kv-filter-regex/266730 "2021-03-09T18:13:28Z")
Hello I have the following message getting from Qradar: ( I have changed some things like ID, logon etc...) A network share object was accessed. Subject: Security ID: ELK\\\\test-test$ Account Name: test-test$ Acc… --- ## [Best layout for inventory Data](https://discuss.elastic.co/t/best-layout-for-inventory-data/266542)
**Author:** [@Eric007](https://discuss.elastic.co/u/Eric007)\ **Replies:** 2\ **Last updated:** [March 9, 2021, 6:13pm UTC](https://discuss.elastic.co/t/best-layout-for-inventory-data/266542 "2021-03-09T18:13:15Z")
Hi, I am realatively new to the topic of Elasticsearch and Kibana. I have set up a small infrastructure with Logstash, Elastisearch and Kibana. Currently, files are successfully routed to my custom index via Logsatash a… --- ## [Elk stack for Network Management - Use Case Confirmation - Discussion](https://discuss.elastic.co/t/elk-stack-for-network-management-use-case-confirmation-discussion/266732)
**Author:** [@marc1](https://discuss.elastic.co/u/marc1)\ **Replies:** 0\ **Last updated:** [March 9, 2021, 5:58pm UTC](https://discuss.elastic.co/t/elk-stack-for-network-management-use-case-confirmation-discussion/266732 "2021-03-09T17:58:05Z")
Hello, I had worked pretty extensively with ELK version 6.x a couple of years ago. I tried out version 7.1x yesterday and was blown away by the improvements that have been added to the platform. Truly great stuff. The … --- ## [I need to transform String field with numbers in format (yyyyddmmHHMM) to a Date field](https://discuss.elastic.co/t/i-need-to-transform-string-field-with-numbers-in-format-yyyyddmmhhmm-to-a-date-field/266727)
**Author:** [@jonhmb](https://discuss.elastic.co/u/jonhmb)\ **Replies:** 2\ **Last updated:** [March 9, 2021, 5:44pm UTC](https://discuss.elastic.co/t/i-need-to-transform-string-field-with-numbers-in-format-yyyyddmmhhmm-to-a-date-field/266727 "2021-03-09T17:44:38Z")
I have logs from a Jenkins application and I need this LastCommitDate to be really a date, but it is a String How can i transform it to a Date field? I need to transform even the past logs, so it will propably be need… --- ## [Convert field containing a timestamp from string to a date / time or timestamp?](https://discuss.elastic.co/t/convert-field-containing-a-timestamp-from-string-to-a-date-time-or-timestamp/265594)
**Author:** [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Replies:** 47\ **Last updated:** [March 9, 2021, 5:34pm UTC](https://discuss.elastic.co/t/convert-field-containing-a-timestamp-from-string-to-a-date-time-or-timestamp/265594 "2021-03-09T17:34:55Z")
Hello As you can observe here, I have a two fields containing date and time: Id like to change it so Elastic stores it as a date/time and maybe even change the order (yyyy/mm/dd hh/mm ) How can I change this? My lo… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1514) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1516)