# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1532 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1533 --- ## [Trying to find saved dashboard](https://discuss.elastic.co/t/trying-to-find-saved-dashboard/265651)
**Author:** [@nicks1993](https://discuss.elastic.co/u/nicks1993)\ **Replies:** 10\ **Last updated:** [February 27, 2021, 1:35am UTC](https://discuss.elastic.co/t/trying-to-find-saved-dashboard/265651 "2021-02-27T01:35:11Z")
I was under the impression that saved objects would be saved in a .kibana/ directory or index found here /usr/share/elasticsearch/data/nodes/0/indices But that is not the case, my kibana.yml is found here, I run kibana… --- ## [How to manage multitenant ELK Cluster](https://discuss.elastic.co/t/how-to-manage-multitenant-elk-cluster/265606)
**Author:** [@verdienansein](https://discuss.elastic.co/u/verdienansein)\ **Replies:** 1\ **Last updated:** [February 27, 2021, 12:18am UTC](https://discuss.elastic.co/t/how-to-manage-multitenant-elk-cluster/265606 "2021-02-27T00:18:52Z")
Hi, in our project we are using a multitenant cluster where several applications are logging to it with weekly log indices. We are facing now a problem because some of these applications are creating very big indices o… --- ## [Extracting some fields from an array item and renaming them with Auditbeat's processors](https://discuss.elastic.co/t/extracting-some-fields-from-an-array-item-and-renaming-them-with-auditbeats-processors/265408)
**Author:** [@alanoe](https://discuss.elastic.co/u/alanoe)\ **Replies:** 3\ **Last updated:** [February 27, 2021, 12:12am UTC](https://discuss.elastic.co/t/extracting-some-fields-from-an-array-item-and-renaming-them-with-auditbeats-processors/265408 "2021-02-27T00:12:54Z")
I'm trying to use Auditbeat to create a filesystem tracker. When I touch a file in the directory watched by my audit rules, I get the following event from Auditbeat saved to Elasticsearch: { "\_index":"auditbea… --- ## [Directory ELK Stack](https://discuss.elastic.co/t/directory-elk-stack/265576)
**Author:** [@alipujaistopo](https://discuss.elastic.co/u/alipujaistopo)\ **Replies:** 1\ **Last updated:** [February 26, 2021, 9:00pm UTC](https://discuss.elastic.co/t/directory-elk-stack/265576 "2021-02-26T21:00:22Z")
guys, where is the default log's directory in server elasticsearch? because there are several policies in my company, please help me what directories should be accessible on this ELK stack? thanks --- ## [Archiving Elasticsearch Data](https://discuss.elastic.co/t/archiving-elasticsearch-data/265575)
**Author:** [@roh689](https://discuss.elastic.co/u/roh689)\ **Replies:** 1\ **Last updated:** [February 26, 2021, 8:59pm UTC](https://discuss.elastic.co/t/archiving-elasticsearch-data/265575 "2021-02-26T20:59:23Z")
I would like to know how we can do Archiving of Elasticsearch data. We want to move all logs older that 30 days to Azure Blob Storage and retrieve it as when require to show in Kibana. We want to reduce the size of Data… --- ## [AIX support](https://discuss.elastic.co/t/aix-support/265666)
**Author:** [@Ismael](https://discuss.elastic.co/u/Ismael)\ **Replies:** 1\ **Last updated:** [February 26, 2021, 8:58pm UTC](https://discuss.elastic.co/t/aix-support/265666 "2021-02-26T20:58:20Z")
Hello, I'm watching in the Elastic Support Matrix that AIX is not supported by any beat or logstash version. I want to know if you have plans to have this function or if there are other ways to install beats in this S.O… --- ## [Get count of lines in a multiline message field](https://discuss.elastic.co/t/get-count-of-lines-in-a-multiline-message-field/265649)
**Author:** [@Pavani\_Reddy](https://discuss.elastic.co/u/Pavani_Reddy)\ **Replies:** 2\ **Last updated:** [February 26, 2021, 8:58pm UTC](https://discuss.elastic.co/t/get-count-of-lines-in-a-multiline-message-field/265649 "2021-02-26T20:58:16Z")
Hi Team, I have a message field with multiline i.e Exception in thread "main" java.lang.IllegalStateException: A book has a null property\\n\\tat com.example.myproject.Author.getBookIds(Author.java:38) \\n\\tat com.exampl… --- ## [Index repeatedly gets "stuck" with high index writer memory usage](https://discuss.elastic.co/t/index-repeatedly-gets-stuck-with-high-index-writer-memory-usage/265526)
**Author:** [@shr](https://discuss.elastic.co/u/shr)\ **Replies:** 3\ **Last updated:** [February 26, 2021, 8:54pm UTC](https://discuss.elastic.co/t/index-repeatedly-gets-stuck-with-high-index-writer-memory-usage/265526 "2021-02-26T20:54:56Z")
Running ES 7.11.0 on Google Kubernetes Engine via ECK 1.4.0. Three-node cluster with each VM having 4 vCPUs, 16GB RAM, 3TB persistent disk. I am loading data into several time-based indices. Most of them are fine, but o… --- ## [Sometimes index template change after node reboot](https://discuss.elastic.co/t/sometimes-index-template-change-after-node-reboot/265239)
**Author:** [@Mohammad.ali](https://discuss.elastic.co/u/Mohammad.ali)\ **Replies:** 5\ **Last updated:** [February 26, 2021, 8:53pm UTC](https://discuss.elastic.co/t/sometimes-index-template-change-after-node-reboot/265239 "2021-02-26T20:53:37Z")
Hi everyone, regarding to my needs i defined a index template with PUT \_template API in kibana! on that template i set index pattern and specific index rollover alias.i send my logs from filebeat to logstash,,in logstas… --- ## [Elasticsearch aggregation on a field with dynamic properties](https://discuss.elastic.co/t/elasticsearch-aggregation-on-a-field-with-dynamic-properties/265667)
**Author:** [@gkeswani92](https://discuss.elastic.co/u/gkeswani92)\ **Replies:** 0\ **Last updated:** [February 26, 2021, 8:42pm UTC](https://discuss.elastic.co/t/elasticsearch-aggregation-on-a-field-with-dynamic-properties/265667 "2021-02-26T20:42:32Z")
Given the following mapping where variants are a nested type and options is a flattened type: { "doc\_type" : "product", "id" : 1, "variants" : \[ { "options" : { "Size" : "XS", }, "pri… --- ## [Field limits for objects vs flattened documents](https://discuss.elastic.co/t/field-limits-for-objects-vs-flattened-documents/265663)
**Author:** [@acmatt](https://discuss.elastic.co/u/acmatt)\ **Replies:** 0\ **Last updated:** [February 26, 2021, 8:19pm UTC](https://discuss.elastic.co/t/field-limits-for-objects-vs-flattened-documents/265663 "2021-02-26T20:19:05Z")
I recently ran into an issue when creating indexes and wanted to confirm if my understanding was correct. When I attempt to create a new index, with a total\_fields.limit of 1, and a single object with a single field I r… --- ## [JAVA\_HOME not getting set via chef (provider\_configure.rb)](https://discuss.elastic.co/t/java-home-not-getting-set-via-chef-provider-configure-rb/265659)
**Author:** [@sb116](https://discuss.elastic.co/u/sb116)\ **Replies:** 0\ **Last updated:** [February 26, 2021, 7:56pm UTC](https://discuss.elastic.co/t/java-home-not-getting-set-via-chef-provider-configure-rb/265659 "2021-02-26T19:56:46Z")
Hello, I would like to set JAVA\_HOME at \`/etc/default/elasticsearch\` via \`provider\_configure.rb\`, and I setting up JAVA\_HOME via role; for some reason, the env variable is not getting set on the target host. Any thought… --- ## [Translate Regex Not Working](https://discuss.elastic.co/t/translate-regex-not-working/265628)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 11\ **Last updated:** [February 26, 2021, 7:02pm UTC](https://discuss.elastic.co/t/translate-regex-not-working/265628 "2021-02-26T19:02:38Z")
Regular Expression on Translate filter isn't working as expected. All values in the destination field are matching low. Values will range from 0.0 to 10 with no more than 1 digit after the decimal. translate { fie… --- ## [Elasticsearch 7.6.2 fails to start up with BCFKS enforcement](https://discuss.elastic.co/t/elasticsearch-7-6-2-fails-to-start-up-with-bcfks-enforcement/265646)
**Author:** [@Mili\_Kahi](https://discuss.elastic.co/u/Mili_Kahi)\ **Replies:** 1\ **Last updated:** [February 26, 2021, 6:28pm UTC](https://discuss.elastic.co/t/elasticsearch-7-6-2-fails-to-start-up-with-bcfks-enforcement/265646 "2021-02-26T18:28:39Z")
We have customized the entry point for Elasticsearch process. In that, we are enforcing to us BCFKS keystore. However, Elasticsearch xpack stack is trying to load with default keytype (JKS) and that is causing error in s… --- ## [Reindexing is failing](https://discuss.elastic.co/t/reindexing-is-failing/265387)
**Author:** [@mouli\_v](https://discuss.elastic.co/u/mouli_v)\ **Replies:** 6\ **Last updated:** [February 26, 2021, 5:26pm UTC](https://discuss.elastic.co/t/reindexing-is-failing/265387 "2021-02-26T17:26:54Z")
We are trying to reindex 2+Tb indexed data between 2 clusters: Cluster size: 6 Reindexing commands: curl -XPOST "http://localhost:9200/\_reindex?scroll=5m&wait\_for\_completion=false" -H 'Content-Type: application/json' … --- ## [AWS S3 based logs integration error using filebeat](https://discuss.elastic.co/t/aws-s3-based-logs-integration-error-using-filebeat/265642)
**Author:** [@dinesh.jiyani](https://discuss.elastic.co/u/dinesh.jiyani)\ **Replies:** 0\ **Last updated:** [February 26, 2021, 5:21pm UTC](https://discuss.elastic.co/t/aws-s3-based-logs-integration-error-using-filebeat/265642 "2021-02-26T17:21:50Z")
Hi We try to fetch AWS s3 base logs using filebeat but we are getting below error. Elasticsearch version : elasticsearch 7.11.1 Kibana version: kibana 7.11.1 Filebeat version: filebeat-7.11.1 aws.yml module config… --- ## [Customizing Stack Management Page in Kibana](https://discuss.elastic.co/t/customizing-stack-management-page-in-kibana/258493)
**Author:** [@Amphagory](https://discuss.elastic.co/u/Amphagory)\ **Replies:** 11\ **Last updated:** [February 26, 2021, 3:18pm UTC](https://discuss.elastic.co/t/customizing-stack-management-page-in-kibana/258493 "2021-02-26T15:18:37Z")
I would like to customize the stack management page as we only require access to the reporting link. I want to remove the other links since 99% of the user accessing this page will not have access to it. I would like t… --- ## [Total hits count not equal to doc\_count total](https://discuss.elastic.co/t/total-hits-count-not-equal-to-doc-count-total/264863)
**Author:** [@rivariv](https://discuss.elastic.co/u/rivariv)\ **Replies:** 0\ **Last updated:** [February 19, 2021, 1:29pm UTC](https://discuss.elastic.co/t/total-hits-count-not-equal-to-doc-count-total/264863 "2021-02-19T13:29:54Z")
Hi! I am using bucket aggregation- terms. Something is going wrong and I cannot seem to solve it. Spent a lot of time already. The total keys I have in my bucket and their doc\_count sum is not coming to be equal total … --- ## [Multiple file paths for the path parameter in Logstash 7.10](https://discuss.elastic.co/t/multiple-file-paths-for-the-path-parameter-in-logstash-7-10/265640)
**Author:** [@lostsoul352](https://discuss.elastic.co/u/lostsoul352)\ **Replies:** 0\ **Last updated:** [February 26, 2021, 5:03pm UTC](https://discuss.elastic.co/t/multiple-file-paths-for-the-path-parameter-in-logstash-7-10/265640 "2021-02-26T17:03:13Z")
According to the Logstash 7.10 documentation the Path parameter for logstash file input is an array. I tried this: file { path =\> \[ "/data/logs/testing/servers/\*\*/server\*.log", "/data/logs/testing/server… --- ## [Watch Execution results does not go past Firing state](https://discuss.elastic.co/t/watch-execution-results-does-not-go-past-firing-state/264377)
**Author:** [@Saugat\_Mukherjee](https://discuss.elastic.co/u/Saugat_Mukherjee)\ **Replies:** 0\ **Last updated:** [February 16, 2021, 3:51am UTC](https://discuss.elastic.co/t/watch-execution-results-does-not-go-past-firing-state/264377 "2021-02-16T03:51:12Z")
Hi, Very new to elastic. Trying to setup a watch where my ultimate goal is to have an action on slack but first testing it out using a simple logging action. My problem is - when I look at the execution history of the … --- ## [Remove aggregate column from the dataTable](https://discuss.elastic.co/t/remove-aggregate-column-from-the-datatable/265570)
**Author:** [@gobi\_s](https://discuss.elastic.co/u/gobi_s)\ **Replies:** 1\ **Last updated:** [February 26, 2021, 4:44pm UTC](https://discuss.elastic.co/t/remove-aggregate-column-from-the-datatable/265570 "2021-02-26T16:44:55Z")
I want to remove the count column from the table, can you help to how to do that. note: count is the only metric column in the table --- ## [Exported CSV Report from Data Table visualization doesn't show "Total"](https://discuss.elastic.co/t/exported-csv-report-from-data-table-visualization-doesnt-show-total/265061)
**Author:** [@RamyaGowda](https://discuss.elastic.co/u/RamyaGowda)\ **Replies:** 2\ **Last updated:** [February 26, 2021, 4:25pm UTC](https://discuss.elastic.co/t/exported-csv-report-from-data-table-visualization-doesnt-show-total/265061 "2021-02-26T16:25:14Z")
Hello Team ! When i export the the data from Table visualization to a CSV, why total values are not populated in the report. I used "Show Total" option to get Total values, but same is not reflecting in the downloaded … --- ## [How to reset built in elastic password?](https://discuss.elastic.co/t/how-to-reset-built-in-elastic-password/264829)
**Author:** [@gokulnath112](https://discuss.elastic.co/u/gokulnath112)\ **Replies:** 3\ **Last updated:** [February 26, 2021, 4:15pm UTC](https://discuss.elastic.co/t/how-to-reset-built-in-elastic-password/264829 "2021-02-26T16:15:00Z")
Hi Team, I have lost my password for the built-in user "elastic". Please help me to recover the password. Or else shall I do change password for the same user in Kibana "users" page? If I change the password means anyt… --- ## [Querying specific documents by doc \_id via elasticsearch filter plugin in logstash](https://discuss.elastic.co/t/querying-specific-documents-by-doc-id-via-elasticsearch-filter-plugin-in-logstash/265630)
**Author:** [@pratz](https://discuss.elastic.co/u/pratz)\ **Replies:** 0\ **Last updated:** [February 26, 2021, 3:57pm UTC](https://discuss.elastic.co/t/querying-specific-documents-by-doc-id-via-elasticsearch-filter-plugin-in-logstash/265630 "2021-02-26T15:57:25Z")
Using the elasticsearch filter plugin in logstash, can I fetch a particular document via it's \_id (which I obtain from my input data in logstash)? --- ## [How to convert floating value into integer value for usage percentage](https://discuss.elastic.co/t/how-to-convert-floating-value-into-integer-value-for-usage-percentage/265598)
**Author:** [@psganeshk](https://discuss.elastic.co/u/psganeshk)\ **Replies:** 2\ **Last updated:** [February 26, 2021, 3:50pm UTC](https://discuss.elastic.co/t/how-to-convert-floating-value-into-integer-value-for-usage-percentage/265598 "2021-02-26T15:50:03Z")
i need visualise the cpu usage and disk usage percentage value is to integer value --- ## [Dsl querries](https://discuss.elastic.co/t/dsl-querries/265587)
**Author:** [@NourBM](https://discuss.elastic.co/u/NourBM)\ **Replies:** 2\ **Last updated:** [February 26, 2021, 3:34pm UTC](https://discuss.elastic.co/t/dsl-querries/265587 "2021-02-26T15:34:43Z")
Hi, how can i GET those two fields with DSL queries? --- ## [Elasticsearch fails to parse documents with timestamp in the following format due to space "2021-02-23T01:08:06.39502Eastern Daylight Time"](https://discuss.elastic.co/t/elasticsearch-fails-to-parse-documents-with-timestamp-in-the-following-format-due-to-space-2021-02-23t0106-39502eastern-daylight-time/265217)
**Author:** [@Antonis\_Michael](https://discuss.elastic.co/u/Antonis_Michael)\ **Replies:** 2\ **Last updated:** [February 26, 2021, 3:29pm UTC](https://discuss.elastic.co/t/elasticsearch-fails-to-parse-documents-with-timestamp-in-the-following-format-due-to-space-2021-02-23t0106-39502eastern-daylight-time/265217 "2021-02-26T15:29:10Z")
Is there a way ElasticSearch can still map this timestamp field without errors? Thanks, Tony --- ## [How much disk should I have?](https://discuss.elastic.co/t/how-much-disk-should-i-have/265619)
**Author:** [@mahalabobis](https://discuss.elastic.co/u/mahalabobis)\ **Replies:** 0\ **Last updated:** [February 26, 2021, 2:41pm UTC](https://discuss.elastic.co/t/how-much-disk-should-i-have/265619 "2021-02-26T14:41:54Z")
How can I know how much disk space I need for Elasticsearch? Right now I'm having unassigned shards because I'm hitting the disk threshold. How much disk growth should I expect? --- ## [Filebeat daemon set misses last few lines of log on pod crash](https://discuss.elastic.co/t/filebeat-daemon-set-misses-last-few-lines-of-log-on-pod-crash/265621)
**Author:** [@val](https://discuss.elastic.co/u/val)\ **Replies:** 0\ **Last updated:** [February 26, 2021, 3:03pm UTC](https://discuss.elastic.co/t/filebeat-daemon-set-misses-last-few-lines-of-log-on-pod-crash/265621 "2021-02-26T15:03:49Z")
I’ve encountered an interesting situation with Filebeat deployed as a daemon set in Openshift (very similar to https://discuss.elastic.co/t/filebeat-missing-end-of-logs-for-k8s-pods/217281). So, we have one dedicated po… --- ## [Split event into multiples and parse with grok separately](https://discuss.elastic.co/t/split-event-into-multiples-and-parse-with-grok-separately/265322)
**Author:** [@Daniel\_Jankech](https://discuss.elastic.co/u/Daniel_Jankech)\ **Replies:** 2\ **Last updated:** [February 26, 2021, 2:45pm UTC](https://discuss.elastic.co/t/split-event-into-multiples-and-parse-with-grok-separately/265322 "2021-02-26T14:45:27Z")
Hello, I'm back with another question. From my understanding split function is used to split lets say messages into multiple lines of code and then you use grok to parse this into a single list of variables. However what… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1531) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1533)