# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1633 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1634 --- ## [Dynamically update a target index after completion of indexing (When combining two indexes)](https://discuss.elastic.co/t/dynamically-update-a-target-index-after-completion-of-indexing-when-combining-two-indexes/259290)
**Author:** [@Alfar](https://discuss.elastic.co/u/Alfar)\ **Replies:** 0\ **Last updated:** [December 21, 2020, 4:52pm UTC](https://discuss.elastic.co/t/dynamically-update-a-target-index-after-completion-of-indexing-when-combining-two-indexes/259290 "2020-12-21T16:52:11Z")
Hi, I have used enrich index (addresses) to ingest to incoming documents(customers) in order to combine both indexes(customers and addresses). The indexes have fields as below Customers : name, age, email, address\_id … --- ## [Filebeat Event Hub Beat - Stuck on Blob already exists](https://discuss.elastic.co/t/filebeat-event-hub-beat-stuck-on-blob-already-exists/259307)
**Author:** [@jkaufmanlr](https://discuss.elastic.co/u/jkaufmanlr)\ **Replies:** 2\ **Last updated:** [December 21, 2020, 10:58pm UTC](https://discuss.elastic.co/t/filebeat-event-hub-beat-stuck-on-blob-already-exists/259307 "2020-12-21T22:58:14Z")
I know I have another topic open but this I am kind of stuck on: PUT https://storageName.blob.core.windows.net/hubName/0?timeout=61 Authorization: REDACTED RESPONSE Status: 409 The specified blob already exists. ERRO… --- ## [Filebeats issue](https://discuss.elastic.co/t/filebeats-issue/258255)
**Author:** [@egS](https://discuss.elastic.co/u/egS)\ **Replies:** 1\ **Last updated:** [December 21, 2020, 10:38pm UTC](https://discuss.elastic.co/t/filebeats-issue/258255 "2020-12-21T22:38:45Z")
Trying to get IBM MQ logs. Have success with the following commands and actions: curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-7.10.1-x86\_64.rpm sudo rpm -vi filebeat-7.10.1-x86\_64.rpm Modif… --- ## [Copy Watcher Rules from Production cluster to DR cluster](https://discuss.elastic.co/t/copy-watcher-rules-from-production-cluster-to-dr-cluster/258712)
**Author:** [@jancodenew](https://discuss.elastic.co/u/jancodenew)\ **Replies:** 1\ **Last updated:** [December 21, 2020, 10:03pm UTC](https://discuss.elastic.co/t/copy-watcher-rules-from-production-cluster-to-dr-cluster/258712 "2020-12-21T22:03:52Z")
Hi, Please help me to copy the watcher rules from prod cluster to DR cluster. Thanks in advance --- ## [Make Beats listen on localhost AND external IPs?](https://discuss.elastic.co/t/make-beats-listen-on-localhost-and-external-ips/259278)
**Author:** [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Replies:** 2\ **Last updated:** [December 21, 2020, 10:01pm UTC](https://discuss.elastic.co/t/make-beats-listen-on-localhost-and-external-ips/259278 "2020-12-21T22:01:43Z")
Hello I want to able to make Beats all listen on the localhost AND on the external IP (or at least bind it to a IP) All I see is creating a reverse proxy with Nginx and its something I rather avoid. How can I do this? … --- ## [Run two winlogbeat instances on the same machine](https://discuss.elastic.co/t/run-two-winlogbeat-instances-on-the-same-machine/259238)
**Author:** [@borna\_talebi](https://discuss.elastic.co/u/borna_talebi)\ **Replies:** 3\ **Last updated:** [December 21, 2020, 9:58pm UTC](https://discuss.elastic.co/t/run-two-winlogbeat-instances-on-the-same-machine/259238 "2020-12-21T21:58:56Z")
Hi, I want to send my winlogbeat data to two different ES clusters. As far as I know, winlogbeat can't have several outputs. Is there a way to run two winlogbeat instances with different configs on the same machine? --- ## [Bool Queries - Filtering double negatives](https://discuss.elastic.co/t/bool-queries-filtering-double-negatives/258217)
**Author:** [@Stephen\_Kneubuehl](https://discuss.elastic.co/u/Stephen_Kneubuehl)\ **Replies:** 1\ **Last updated:** [December 21, 2020, 9:51pm UTC](https://discuss.elastic.co/t/bool-queries-filtering-double-negatives/258217 "2020-12-21T21:51:01Z")
Hey everyone, I need help with query syntax! I'm trying to build a compound bool query that filters out documents that do not match a certain criteria, essentially a double negative. I want to return relevant events f… --- ## [Make Kibana listen on localhost AND external IPs?](https://discuss.elastic.co/t/make-kibana-listen-on-localhost-and-external-ips/259277)
**Author:** [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Replies:** 1\ **Last updated:** [December 21, 2020, 9:49pm UTC](https://discuss.elastic.co/t/make-kibana-listen-on-localhost-and-external-ips/259277 "2020-12-21T21:49:04Z")
Hello I want to able to make my Elastic Stack (Elasticsearch, Logstash, Kibana, and Beats) all listen on the localhost AND on the external IP (or at least bind it to a IP) All I see is creating a reverse proxy with Ngi… --- ## [Make Logstash listen on localhost AND external IPs?](https://discuss.elastic.co/t/make-logstash-listen-on-localhost-and-external-ips/259276)
**Author:** [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Replies:** 1\ **Last updated:** [December 21, 2020, 9:48pm UTC](https://discuss.elastic.co/t/make-logstash-listen-on-localhost-and-external-ips/259276 "2020-12-21T21:48:04Z")
Hello I want to able to make my Elastic Stack (Elasticsearch, Logstash, Kibana, and Beats) all listen on the localhost AND on the external IP (or at least bind it to a IP) All I see is creating a reverse proxy with Ngi… --- ## [Make Elastic Stack listen on localhost AND external IPs?](https://discuss.elastic.co/t/make-elastic-stack-listen-on-localhost-and-external-ips/259275)
**Author:** [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Replies:** 3\ **Last updated:** [December 21, 2020, 9:47pm UTC](https://discuss.elastic.co/t/make-elastic-stack-listen-on-localhost-and-external-ips/259275 "2020-12-21T21:47:37Z")
Hello I want to able to make my Elastic Stack (Elasticsearch, Logstash, Kibana, and Beats) all listen on the localhost AND on the external IP (or at least bind it to a IP) All I see is creating a reverse proxy with Ngi… --- ## [Elasticsearch curl error](https://discuss.elastic.co/t/elasticsearch-curl-error/259297)
**Author:** [@hassan.rana](https://discuss.elastic.co/u/hassan.rana)\ **Replies:** 1\ **Last updated:** [December 21, 2020, 9:46pm UTC](https://discuss.elastic.co/t/elasticsearch-curl-error/259297 "2020-12-21T21:46:34Z")
I am trying to curl some fields/information out of elasticsearch ( to run as zabbix external checks) but can not see the output from any other machine. Blockquote curl -v -XGET "http://10.100.0.0:9200/filebeat\*/\_sea… --- ## [Need to visualize consistently failing tests](https://discuss.elastic.co/t/need-to-visualize-consistently-failing-tests/259299)
**Author:** [@larrya](https://discuss.elastic.co/u/larrya)\ **Replies:** 2\ **Last updated:** [December 21, 2020, 9:45pm UTC](https://discuss.elastic.co/t/need-to-visualize-consistently-failing-tests/259299 "2020-12-21T21:45:12Z")
I am trying to calculate consistently failing tests over the past 48 hours. For my index I have test results with two significant fields: test\_identifier (string) and test\_result\_status (pass or fail). I would like to d… --- ## [Visualize Amount of Data written to elastic in the last 24h per Index](https://discuss.elastic.co/t/visualize-amount-of-data-written-to-elastic-in-the-last-24h-per-index/258988)
**Author:** [@Kosodrom](https://discuss.elastic.co/u/Kosodrom)\ **Replies:** 3\ **Last updated:** [December 21, 2020, 9:44pm UTC](https://discuss.elastic.co/t/visualize-amount-of-data-written-to-elastic-in-the-last-24h-per-index/258988 "2020-12-21T21:44:00Z")
Hi folks, I have following use case: I want to have a visualization (lets say a gauge) which indicates how much data customer writes to an index in the last 24h Can you help me about how I can achive this? So far in … --- ## [Kibana does not show timeframe in discover](https://discuss.elastic.co/t/kibana-does-not-show-timeframe-in-discover/259303)
**Author:** [@snolfi](https://discuss.elastic.co/u/snolfi)\ **Replies:** 1\ **Last updated:** [December 21, 2020, 9:25pm UTC](https://discuss.elastic.co/t/kibana-does-not-show-timeframe-in-discover/259303 "2020-12-21T21:25:34Z")
Hello, we are working on kibana 6. It's a SaaS on AWS. We noticed that in discover section there is not the timeframe option to select data, neither the graph the shows how documents are arriving from beats. What co… --- ## [Datastream does not rollover properly](https://discuss.elastic.co/t/datastream-does-not-rollover-properly/259295)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 3\ **Last updated:** [December 21, 2020, 7:37pm UTC](https://discuss.elastic.co/t/datastream-does-not-rollover-properly/259295 "2020-12-21T19:37:43Z")
I have a data stream that I am writing to and which has reached its rollover point -- current actions says rollover but there is no 000002 index. Time given for the rollover is 8 hours ago: definition: { "policy"… --- ## [Add date{} config make logstash not working](https://discuss.elastic.co/t/add-date-config-make-logstash-not-working/259213)
**Author:** [@azteker](https://discuss.elastic.co/u/azteker)\ **Replies:** 5\ **Last updated:** [December 21, 2020, 7:36pm UTC](https://discuss.elastic.co/t/add-date-config-make-logstash-not-working/259213 "2020-12-21T19:36:13Z")
I add date{} config into filter {}, but then the log is not passed to elasticseatch(cannot see new log in kibana). Logs are back if I removed the date config. This is the date config I added: date { match =\> \["ts"… --- ## [Filebeat data extra Fields not populating in raw logs](https://discuss.elastic.co/t/filebeat-data-extra-fields-not-populating-in-raw-logs/259033)
**Author:** [@jkaufmanlr](https://discuss.elastic.co/u/jkaufmanlr)\ **Replies:** 2\ **Last updated:** [December 21, 2020, 5:50pm UTC](https://discuss.elastic.co/t/filebeat-data-extra-fields-not-populating-in-raw-logs/259033 "2020-12-21T17:50:04Z")
There are some additional log variables that I want ingesting into my logstash. I have the logs ingesting and can see the Event Hub Beats just fine. But these specific values that I will be able to spot within event hub … --- ## [Magento 2.3.5 p1 - Elastic Search 7.7. /var/www/html/vendor/elasticsearch/elasticsearch/src/Elasticsearch/Connections/Connection.php:632)](https://discuss.elastic.co/t/magento-2-3-5-p1-elastic-search-7-7-var-www-html-vendor-elasticsearch-elasticsearch-src-elasticsearch-connections-connection-php-632/259182)
**Author:** [@danielJ](https://discuss.elastic.co/u/danielJ)\ **Replies:** 2\ **Last updated:** [December 21, 2020, 5:37pm UTC](https://discuss.elastic.co/t/magento-2-3-5-p1-elastic-search-7-7-var-www-html-vendor-elasticsearch-elasticsearch-src-elasticsearch-connections-connection-php-632/259182 "2020-12-21T17:37:07Z")
Hello Team, I am using Magento 2.3.5p1 using mysql on an AWS EC2 instance with installed Elasticsearch version 7.7. I get the test successful but on the front end the search does not work with there's no item matching y… --- ## [How to know the time when elasticsearch indexed the data](https://discuss.elastic.co/t/how-to-know-the-time-when-elasticsearch-indexed-the-data/258603)
**Author:** [@soufian.eldouqe](https://discuss.elastic.co/u/soufian.eldouqe)\ **Replies:** 9\ **Last updated:** [December 21, 2020, 5:31pm UTC](https://discuss.elastic.co/t/how-to-know-the-time-when-elasticsearch-indexed-the-data/258603 "2020-12-21T17:31:15Z")
Hello, is there any way to know the time that elasticsearch indexed the data ? in others words, when did the index received de data. Thank you --- ## [Elasticsearch returns documents with score 0.0](https://discuss.elastic.co/t/elasticsearch-returns-documents-with-score-0-0/259289)
**Author:** [@haitran](https://discuss.elastic.co/u/haitran)\ **Replies:** 0\ **Last updated:** [December 21, 2020, 4:40pm UTC](https://discuss.elastic.co/t/elasticsearch-returns-documents-with-score-0-0/259289 "2020-12-21T16:40:29Z")
Please help me to understand the scoring logic. Configuration: PUT /my-index-000001 { "mappings": { "dynamic": "false", "properties": { "test": { "type": "text", "fields": { "\_… --- ## [Another dateparse failure](https://discuss.elastic.co/t/another-dateparse-failure/259089)
**Author:** [@calanon](https://discuss.elastic.co/u/calanon)\ **Replies:** 3\ **Last updated:** [December 21, 2020, 4:57pm UTC](https://discuss.elastic.co/t/another-dateparse-failure/259089 "2020-12-21T16:57:41Z")
I cant figure out how to match this: RAW output \[2020-12-17T16:45:45+01:00\] Elasticsearch JSON Dez 18 11:03:58 mon logstash\[23980\]: "log\_timestamp" =\> "2020-12-18T11:03:56+01:00", Dez 18 11:03:58 mon logstash\[239… --- ## [Aggregate by multiple fields and Top 10 count in ElasticSearcch](https://discuss.elastic.co/t/aggregate-by-multiple-fields-and-top-10-count-in-elasticsearcch/259286)
**Author:** [@Prabhu.292](https://discuss.elastic.co/u/Prabhu.292)\ **Replies:** 0\ **Last updated:** [December 21, 2020, 4:33pm UTC](https://discuss.elastic.co/t/aggregate-by-multiple-fields-and-top-10-count-in-elasticsearcch/259286 "2020-12-21T16:33:12Z")
Dear Team, I have query like this GET logstash-sdc-questionrecords/\_search?q=source:website\_portal { "aggs" : { "genres" : { "terms" : { "field" : "question.keyword", "order" : { "\_count" : "desc" }, "size": 10 … --- ## [Test Dependency on elasticsearch-test.jar for plugins](https://discuss.elastic.co/t/test-dependency-on-elasticsearch-test-jar-for-plugins/259283)
**Author:** [@Bukhtawar\_Khan](https://discuss.elastic.co/u/Bukhtawar_Khan)\ **Replies:** 0\ **Last updated:** [December 21, 2020, 4:03pm UTC](https://discuss.elastic.co/t/test-dependency-on-elasticsearch-test-jar-for-plugins/259283 "2020-12-21T16:03:49Z")
Is there a way a plugin developer can leverage existing ES tests apart from elasticsearch-framework itself. --- ## [Elasticsearch sizing for Production POC](https://discuss.elastic.co/t/elasticsearch-sizing-for-production-poc/259268)
**Author:** [@Abdelhalim](https://discuss.elastic.co/u/Abdelhalim)\ **Replies:** 0\ **Last updated:** [December 21, 2020, 2:12pm UTC](https://discuss.elastic.co/t/elasticsearch-sizing-for-production-poc/259268 "2020-12-21T14:12:12Z")
Hello everybody, It's the first time that I am going to run a cluster for a production POC and I need some help in the way that I size my machines. Knowing that I am going to have like 15Go of data per day, and knowing… --- ## [Elasticsearch transform role backward compatibility](https://discuss.elastic.co/t/elasticsearch-transform-role-backward-compatibility/259254)
**Author:** [@Mohammad\_Mousavi](https://discuss.elastic.co/u/Mohammad_Mousavi)\ **Replies:** 1\ **Last updated:** [December 21, 2020, 1:36pm UTC](https://discuss.elastic.co/t/elasticsearch-transform-role-backward-compatibility/259254 "2020-12-21T13:36:16Z")
Hi, I have a 3 nodes elasticsearch cluster with 7.4.2 version. It's look like this version does not support "transform role". I see in elasticsearch version 7.10.1 logs that a module called "transform" is loaded in star… --- ## [How to connect logstash from logstash?](https://discuss.elastic.co/t/how-to-connect-logstash-from-logstash/259258)
**Author:** [@iooi](https://discuss.elastic.co/u/iooi)\ **Replies:** 0\ **Last updated:** [December 21, 2020, 1:33pm UTC](https://discuss.elastic.co/t/how-to-connect-logstash-from-logstash/259258 "2020-12-21T13:33:22Z")
I want to use one logstash send data to multiple logstash services. If I use this setting in k8s, it can work. service.yml apiVersion: v1 kind: Service metadata: labels: app: logstash name: logstash spec: se… --- ## [Convert graphite field name in to tags](https://discuss.elastic.co/t/convert-graphite-field-name-in-to-tags/259257)
**Author:** [@Mario\_Giammarco](https://discuss.elastic.co/u/Mario_Giammarco)\ **Replies:** 0\ **Last updated:** [December 21, 2020, 1:30pm UTC](https://discuss.elastic.co/t/convert-graphite-field-name-in-to-tags/259257 "2020-12-21T13:30:39Z")
Hello, I am a logstash newbie. I have this problem: I receive data from graphite. Data is in this format: computername.cpu.load.cpu0 = 10 I would like to insert this into elastic search: tags=\> \[ computername, cpu,… --- ## [Watcher Acked automatic](https://discuss.elastic.co/t/watcher-acked-automatic/259253)
**Author:** [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\ **Replies:** 0\ **Last updated:** [December 21, 2020, 12:56pm UTC](https://discuss.elastic.co/t/watcher-acked-automatic/259253 "2020-12-21T12:56:26Z")
Hi, guys I'd like to know if it's possible to make a watcher where I send a HTTP request and execute the API REST: POST, every time another alert is activated in 'firing'? make like an 'automatic acked' since inside it … --- ## [Filebeat not reading .out file from filebeat.inputs path](https://discuss.elastic.co/t/filebeat-not-reading-out-file-from-filebeat-inputs-path/258413)
**Author:** [@arjun\_gowda](https://discuss.elastic.co/u/arjun_gowda)\ **Replies:** 3\ **Last updated:** [December 21, 2020, 12:05pm UTC](https://discuss.elastic.co/t/filebeat-not-reading-out-file-from-filebeat-inputs-path/258413 "2020-12-21T12:05:56Z")
Filebeat is not reading .out file from filebeat.inputs path. I want to read the nohup.out files in the log folder. Please help me with the configuration Here's the filebeat.yml. filebeat.inputs: type: log Change to t… --- ## [Elasticsearch Python Cache](https://discuss.elastic.co/t/elasticsearch-python-cache/259246)
**Author:** [@satyamsinghal575](https://discuss.elastic.co/u/satyamsinghal575)\ **Replies:** 0\ **Last updated:** [December 21, 2020, 11:52am UTC](https://discuss.elastic.co/t/elasticsearch-python-cache/259246 "2020-12-21T11:52:05Z")
I am using elasticsearch primarily for aggregations, then eventually i came across setting the query size to zero, according to my understanding this helps in two ways : payload size is reduced and when we use query in… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1632) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1634)