# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1750 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1751 --- ## [Is there any way to disbale Kibana News and Help buttons?](https://discuss.elastic.co/t/is-there-any-way-to-disbale-kibana-news-and-help-buttons/252084)
**Author:** [@elasticheart](https://discuss.elastic.co/u/elasticheart)\ **Replies:** 1\ **Last updated:** [October 14, 2020, 8:30pm UTC](https://discuss.elastic.co/t/is-there-any-way-to-disbale-kibana-news-and-help-buttons/252084 "2020-10-14T20:30:24Z")
Hi, I am using Elastic Stack 7.9.2 and I would like to disable Help and News Feed buttons from Kibana; I have alrady disabled newsfeed system configuration in kibana.yml file; newsfeed.enabled: false but still, I a… --- ## [ILM keeping rolling over the same old indexes daily](https://discuss.elastic.co/t/ilm-keeping-rolling-over-the-same-old-indexes-daily/252097)
**Author:** [@dobesv](https://discuss.elastic.co/u/dobesv)\ **Replies:** 7\ **Last updated:** [October 14, 2020, 8:27pm UTC](https://discuss.elastic.co/t/ilm-keeping-rolling-over-the-same-old-indexes-daily/252097 "2020-10-14T20:27:52Z")
Hi, I have fluentd pushing logs into elasticsearch with index names based on the date, e.g. logs.kubelet.YYYY.MM.DD and using index lifecycle management (ILM). I have set the ILM policy to roll over after 50GB or daily… --- ## [Remove field on logstash](https://discuss.elastic.co/t/remove-field-on-logstash/252088)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 2\ **Last updated:** [October 14, 2020, 6:38pm UTC](https://discuss.elastic.co/t/remove-field-on-logstash/252088 "2020-10-14T18:38:49Z")
I am receiving metricbeat data on logstash and I want to remove certain part of it. how can I remove this I try mutate { remove\_field =\> \[ "\[process\]\[args\]0","\[process\]\[args\]1" \] } try mutate { remove\_field =\> \[ "\[p… --- ## [Clarification required for Snapshot policy option \`Wait for snapshot policy\`](https://discuss.elastic.co/t/clarification-required-for-snapshot-policy-option-wait-for-snapshot-policy/252091)
**Author:** [@ajesh](https://discuss.elastic.co/u/ajesh)\ **Replies:** 0\ **Last updated:** [October 14, 2020, 6:25pm UTC](https://discuss.elastic.co/t/clarification-required-for-snapshot-policy-option-wait-for-snapshot-policy/252091 "2020-10-14T18:25:08Z")
Hi There, Can you please help in clarifying below doubts for the option Wait for snapshot policy in the ILM policy. I have a snapshot policy created for auditbeat indices with index pattern selected as auditbeat-\* whic… --- ## [How to get size (total) of events send by a host per day](https://discuss.elastic.co/t/how-to-get-size-total-of-events-send-by-a-host-per-day/251912)
**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\ **Replies:** 3\ **Last updated:** [October 14, 2020, 6:17pm UTC](https://discuss.elastic.co/t/how-to-get-size-total-of-events-send-by-a-host-per-day/251912 "2020-10-14T18:17:41Z")
We have been asked different scenarios What is the original size/volume of data send by a particular host? What is the size/volume of data indexed into ES from a particular host For (1) it is actually the size of the … --- ## [Problems with AND in drop\_events.when.or](https://discuss.elastic.co/t/problems-with-and-in-drop-events-when-or/252066)
**Author:** [@Matthew\_Smith](https://discuss.elastic.co/u/Matthew_Smith)\ **Replies:** 2\ **Last updated:** [October 14, 2020, 5:37pm UTC](https://discuss.elastic.co/t/problems-with-and-in-drop-events-when-or/252066 "2020-10-14T17:37:07Z")
I'm trying to drop a particular event id (4624 or 4627) when the TargetUserName is SYSTEM and then also just always drop event id 5379. What am I doing wrong here? # Needed for Graylog fields\_under\_root: true fields.c… --- ## [Analysing active directory users and computers](https://discuss.elastic.co/t/analysing-active-directory-users-and-computers/252085)
**Author:** [@carpetpants](https://discuss.elastic.co/u/carpetpants)\ **Replies:** 0\ **Last updated:** [October 14, 2020, 5:30pm UTC](https://discuss.elastic.co/t/analysing-active-directory-users-and-computers/252085 "2020-10-14T17:30:57Z")
Hi There, I am looking to analyse active directory users and computers in elastic and wondered if anyone has done this before and able to offer some guidance. What I am looking to achieve is report on the total number o… --- ## [Elastic\_app\_search set engine based on document value](https://discuss.elastic.co/t/elastic-app-search-set-engine-based-on-document-value/252079)
**Author:** [@Tam2](https://discuss.elastic.co/u/Tam2)\ **Replies:** 1\ **Last updated:** [October 14, 2020, 5:24pm UTC](https://discuss.elastic.co/t/elastic-app-search-set-engine-based-on-document-value/252079 "2020-10-14T17:24:55Z")
Within my document, there is a client\_id field I would like to set the engine for my elastic\_app\_search based on this value. So each document goes into the correct engine based on the document's client\_id I tried to do… --- ## [A plugin had an unrecoverable error. Will restart this plugin](https://discuss.elastic.co/t/a-plugin-had-an-unrecoverable-error-will-restart-this-plugin/251913)
**Author:** [@sukumar.koganti](https://discuss.elastic.co/u/sukumar.koganti)\ **Replies:** 12\ **Last updated:** [October 14, 2020, 5:20pm UTC](https://discuss.elastic.co/t/a-plugin-had-an-unrecoverable-error-will-restart-this-plugin/251913 "2020-10-14T17:20:08Z")
Hi Team, I am trying to read my Sql Server table from the DB and here is my .conf file, when i am trying to read the table through logstash i am getting the below error. input { jdbc { jdbc\_driver\_library =\> "C:/Pr… --- ## [Coordinating node configuration](https://discuss.elastic.co/t/coordinating-node-configuration/252080)
**Author:** [@deeps](https://discuss.elastic.co/u/deeps)\ **Replies:** 1\ **Last updated:** [October 14, 2020, 5:19pm UTC](https://discuss.elastic.co/t/coordinating-node-configuration/252080 "2020-10-14T17:19:46Z")
hey there, could someone share the coordinator node config for elasticsearch 7.8.1 version? I tried with node.roles: \[ \] but its not accepting (i believe this is for 7.9 version) and throwing below error: Caused by: … --- ## [Read the Logevent into exec output](https://discuss.elastic.co/t/read-the-logevent-into-exec-output/252077)
**Author:** [@praveenmak](https://discuss.elastic.co/u/praveenmak)\ **Replies:** 0\ **Last updated:** [October 14, 2020, 4:57pm UTC](https://discuss.elastic.co/t/read-the-logevent-into-exec-output/252077 "2020-10-14T16:57:09Z")
Hello folks, I want to get the whole event to a shell script, I am trying to use exec output plugin. Please note, I don't have "message" variable. This is the output in JSON. {"taskid":"vMUKrDoBSX-12349","@version":… --- ## [Aggregation based on Array Intersection](https://discuss.elastic.co/t/aggregation-based-on-array-intersection/252068)
**Author:** [@Charles\_Lariviere](https://discuss.elastic.co/u/Charles_Lariviere)\ **Replies:** 2\ **Last updated:** [October 14, 2020, 4:53pm UTC](https://discuss.elastic.co/t/aggregation-based-on-array-intersection/252068 "2020-10-14T16:53:40Z")
Hi, I'm looking to write a query that will return the "most frequently co-occurring terms given an input of one or more terms", though I'm quite unclear as to how I would structure such a query (or if it is even possibl… --- ## [Issue with deploying Elasticsearch helm chart with dedicated nodes and deleting and re-deploying the release](https://discuss.elastic.co/t/issue-with-deploying-elasticsearch-helm-chart-with-dedicated-nodes-and-deleting-and-re-deploying-the-release/252067)
**Author:** [@mehta-ankit](https://discuss.elastic.co/u/mehta-ankit)\ **Replies:** 2\ **Last updated:** [October 14, 2020, 4:53pm UTC](https://discuss.elastic.co/t/issue-with-deploying-elasticsearch-helm-chart-with-dedicated-nodes-and-deleting-and-re-deploying-the-release/252067 "2020-10-14T16:53:36Z")
I have been using the elasticsearch helm chart from elastic for a long time now, but recently wanted to switch my architecture to use dedicated master and data nodes. I looked at the example provided here: https://githu… --- ## [Watcher case](https://discuss.elastic.co/t/watcher-case/251926)
**Author:** [@victor.vera](https://discuss.elastic.co/u/victor.vera)\ **Replies:** 2\ **Last updated:** [October 14, 2020, 4:41pm UTC](https://discuss.elastic.co/t/watcher-case/251926 "2020-10-14T16:41:48Z")
Good afternoon I'm trying to configure an alert in a unitary way, I mean, that from a field, I get out or equal to a term that I define; what I need is a term that I ask from the field "monitor.name.keyword" to get from … --- ## [Dynamic index name not working with Filebeat](https://discuss.elastic.co/t/dynamic-index-name-not-working-with-filebeat/251284)
**Author:** [@Pablo\_Albertengo](https://discuss.elastic.co/u/Pablo_Albertengo)\ **Replies:** 3\ **Last updated:** [October 14, 2020, 4:45pm UTC](https://discuss.elastic.co/t/dynamic-index-name-not-working-with-filebeat/251284 "2020-10-14T16:45:03Z")
Hi guys! I am not being able to get Filebeat to write documents to indices based on a field. This is my configuration: filebeat.inputs: - type: log # Change to true to enable this input configuration. enabled: tr… --- ## [How to retrieve organizations IP address](https://discuss.elastic.co/t/how-to-retrieve-organizations-ip-address/251911)
**Author:** [@witcher](https://discuss.elastic.co/u/witcher)\ **Replies:** 15\ **Last updated:** [October 14, 2020, 12:56pm UTC](https://discuss.elastic.co/t/how-to-retrieve-organizations-ip-address/251911 "2020-10-14T12:56:33Z")
I am trying to create a visualization which shows the organization the IP address. --- ## [Elasticsearch 5.5 - Ways Export Monitoring](https://discuss.elastic.co/t/elasticsearch-5-5-ways-export-monitoring/252069)
**Author:** [@Beuhlet\_Reseau](https://discuss.elastic.co/u/Beuhlet_Reseau)\ **Replies:** 0\ **Last updated:** [October 14, 2020, 4:13pm UTC](https://discuss.elastic.co/t/elasticsearch-5-5-ways-export-monitoring/252069 "2020-10-14T16:13:43Z")
Hello, I have a large elasticsearch cluster 60 instances Overview Version: 5.5.1 Uptime: 12 days Nodes: 60 Disk Available: 249TB / 413TB (60.26%) JVM Heap: 65.84% (1TB / 2TB) Indices: 2,855 Documents: 24,229,929… --- ## [Setting up Index Lifecycle Policies](https://discuss.elastic.co/t/setting-up-index-lifecycle-policies/251902)
**Author:** [@Gavin\_Clark](https://discuss.elastic.co/u/Gavin_Clark)\ **Replies:** 2\ **Last updated:** [October 14, 2020, 3:40pm UTC](https://discuss.elastic.co/t/setting-up-index-lifecycle-policies/251902 "2020-10-14T15:40:50Z")
We're currently working on setting up a more automated way of keeping our indices and shard count low and saw 'Index Lifecycle Policies' in Kibana which seems very powerful and easy to setup. We've created a policy, but… --- ## [First occurrence field value using ingest processor](https://discuss.elastic.co/t/first-occurrence-field-value-using-ingest-processor/251755)
**Author:** [@liorg2](https://discuss.elastic.co/u/liorg2)\ **Replies:** 2\ **Last updated:** [October 14, 2020, 3:37pm UTC](https://discuss.elastic.co/t/first-occurrence-field-value-using-ingest-processor/251755 "2020-10-14T15:37:54Z")
Hello is there a way to tag a document with "first occurrence of a field" using an ingest processor? for example first occurrence of traffic from Japan (country:Japan) thanks --- ## [How to work on object to get 0,1,2,3 out of it](https://discuss.elastic.co/t/how-to-work-on-object-to-get-0-1-2-3-out-of-it/252040)
**Author:** [@amaleswar](https://discuss.elastic.co/u/amaleswar)\ **Replies:** 1\ **Last updated:** [October 14, 2020, 3:30pm UTC](https://discuss.elastic.co/t/how-to-work-on-object-to-get-0-1-2-3-out-of-it/252040 "2020-10-14T15:30:44Z")
"eventInfo": { "delete.user.0.firstname": "david", "delete.user.0.lastname": "flank", "delete.user.0.city": "austin", "delete.user.1.firstname": "martin", "delete.user.1.lastname": "king", "delete.user.1.city": "da… --- ## [How to change two fields in an index to a geo point?](https://discuss.elastic.co/t/how-to-change-two-fields-in-an-index-to-a-geo-point/252033)
**Author:** [@witcher](https://discuss.elastic.co/u/witcher)\ **Replies:** 5\ **Last updated:** [October 14, 2020, 3:19pm UTC](https://discuss.elastic.co/t/how-to-change-two-fields-in-an-index-to-a-geo-point/252033 "2020-10-14T15:19:47Z")
PUT \_ingest/pipeline/geoip { "description" : "Add geoip info", "processors" : \[ { "geoip" : { "field" : "source\_ip", "database\_file": "GeoLite2-City.mmdb", "target\_field": "sourceip\_geo" } } \] } … --- ## [Logstash - configuration with multiple sources](https://discuss.elastic.co/t/logstash-configuration-with-multiple-sources/252017)
**Author:** [@maria\_lopez\_perez](https://discuss.elastic.co/u/maria_lopez_perez)\ **Replies:** 2\ **Last updated:** [October 14, 2020, 3:18pm UTC](https://discuss.elastic.co/t/logstash-configuration-with-multiple-sources/252017 "2020-10-14T15:18:32Z")
Hello, I try to create a configuration in Logstash in order to have two index in elasticserach relation to two diferentes sources (two files), The configuration is: input { file { path =\> "/etc/logstash/ficheros/disc… --- ## [Elasticserach 7.2 Unable to create cluster with error "Unable to lock JVM Memory: error=12, reason=Cannot allocate memory"](https://discuss.elastic.co/t/elasticserach-7-2-unable-to-create-cluster-with-error-unable-to-lock-jvm-memory-error-12-reason-cannot-allocate-memory/252050)
**Author:** [@bognad](https://discuss.elastic.co/u/bognad)\ **Replies:** 6\ **Last updated:** [October 14, 2020, 2:58pm UTC](https://discuss.elastic.co/t/elasticserach-7-2-unable-to-create-cluster-with-error-unable-to-lock-jvm-memory-error-12-reason-cannot-allocate-memory/252050 "2020-10-14T14:58:36Z")
Hello! Standalone (single-node) Elasticsearch is work fine. I tried creating one node cluster, but it results into error: elasticsearch\_1 | {"type": "server", "timestamp": "2020-10-14T11:38:41,989+0000", "level": "WA… --- ## [Logstash dash "-" (hyphen) problem with aggregation](https://discuss.elastic.co/t/logstash-dash-hyphen-problem-with-aggregation/251947)
**Author:** [@bnmtl](https://discuss.elastic.co/u/bnmtl)\ **Replies:** 8\ **Last updated:** [October 14, 2020, 2:39pm UTC](https://discuss.elastic.co/t/logstash-dash-hyphen-problem-with-aggregation/251947 "2020-10-14T14:39:44Z")
Hello, With my logstash configuration, I am reading JSON log, but in my JSON log I have fields like below; "host-name":"comp-1.example.com", "name-surname":"john-doe" My configuration in logstash; input { file {… --- ## [Count of true values in Kibana data table](https://discuss.elastic.co/t/count-of-true-values-in-kibana-data-table/252052)
**Author:** [@DougR](https://discuss.elastic.co/u/DougR)\ **Replies:** 1\ **Last updated:** [October 14, 2020, 1:46pm UTC](https://discuss.elastic.co/t/count-of-true-values-in-kibana-data-table/252052 "2020-10-14T13:46:42Z")
I'm doing a Kibana data table which looks like: Environment Field1 Field2 Field3 Field4 Dev Sum Sum Sum ??? QA Sum Sum Sum ??? Stage Sum Sum Sum ??? Prod Sum Sum Sum ??? Field1, Field2, and Field3 are n… --- ## [How to send selected field from Kibana to ActiveMQ/application?](https://discuss.elastic.co/t/how-to-send-selected-field-from-kibana-to-activemq-application/252003)
**Author:** [@venkata.kodapaka](https://discuss.elastic.co/u/venkata.kodapaka)\ **Replies:** 1\ **Last updated:** [October 14, 2020, 1:32pm UTC](https://discuss.elastic.co/t/how-to-send-selected-field-from-kibana-to-activemq-application/252003 "2020-10-14T13:32:49Z")
Hi Team, I have few visualizations in my Kibana dashboard where I could see different methods data in linegraph. Eg: 'read','write','readAndWrite' these are all the Java methods for which I've built the line graph with … --- ## [Kibana logs are not shown](https://discuss.elastic.co/t/kibana-logs-are-not-shown/252026)
**Author:** [@sachithmuhandiram](https://discuss.elastic.co/u/sachithmuhandiram)\ **Replies:** 1\ **Last updated:** [October 14, 2020, 1:25pm UTC](https://discuss.elastic.co/t/kibana-logs-are-not-shown/252026 "2020-10-14T13:25:02Z")
I have installed ELK in my Ubuntu-18 server and configured Kubernetes cluster with filebeats. Few days ago, Kibana -\> Logs were showing logs. But now I can not see any log shown there. I had checked kibana and elastic … --- ## [Elasticsearch cluster 5.5 under heavy load](https://discuss.elastic.co/t/elasticsearch-cluster-5-5-under-heavy-load/250471)
**Author:** [@Beuhlet\_Reseau](https://discuss.elastic.co/u/Beuhlet_Reseau)\ **Replies:** 6\ **Last updated:** [October 14, 2020, 1:12pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-5-5-under-heavy-load/250471 "2020-10-14T13:12:02Z")
Hey, I work on Elasticsearch cluster in 5.5 version. About 16 physical workers : 60 java instances (6 coordinators, 3 masters and data nodes) Coord/Data : 30 Go heap / instance Master : 15 Go / instance About 6 To d… --- ## [Start day of week in Advanced settings](https://discuss.elastic.co/t/start-day-of-week-in-advanced-settings/251235)
**Author:** [@amp](https://discuss.elastic.co/u/amp)\ **Replies:** 1\ **Last updated:** [October 14, 2020, 12:50pm UTC](https://discuss.elastic.co/t/start-day-of-week-in-advanced-settings/251235 "2020-10-14T12:50:52Z")
Hi, We are using ELK 7.8 basic version for log management and ITSM reports. Need to show the start day of week in reports as Tuesday and modified the start day as Tuesday in advanced settings in Kibana .But still the s… --- ## [Getting error while starting logstash - Failed to execute action {:id=\>:main, :action\_type=\>LogStash::ConvergeResult::FailedAction, :message=\>"Could not execute action: PipelineAct ion::Create\, action\_result: false", :backtrace=\>nil](https://discuss.elastic.co/t/getting-error-while-starting-logstash-failed-to-execute-action-id-main-action-type-logstash-failedaction-message-could-not-execute-action-pipelineact-ion-create-main-action-result-false-backtrace-nil/252044)
**Author:** [@kanhaiyak424](https://discuss.elastic.co/u/kanhaiyak424)\ **Replies:** 0\ **Last updated:** [October 14, 2020, 12:47pm UTC](https://discuss.elastic.co/t/getting-error-while-starting-logstash-failed-to-execute-action-id-main-action-type-logstash-failedaction-message-could-not-execute-action-pipelineact-ion-create-main-action-result-false-backtrace-nil/252044 "2020-10-14T12:47:48Z")
E:\\ELK\\Software\\logstash-7.9.1\\bin\>logstash -f logstash-simple-jms.conf Java HotSpot(TM) 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 and will likely be removed in a future release. … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1749) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1751)