# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1787 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1788 --- ## [Merge two index to create third index using logstash](https://discuss.elastic.co/t/merge-two-index-to-create-third-index-using-logstash/249767)
**Author:** [@Abhi6](https://discuss.elastic.co/u/Abhi6)\ **Replies:** 1\ **Last updated:** [September 24, 2020, 2:56pm UTC](https://discuss.elastic.co/t/merge-two-index-to-create-third-index-using-logstash/249767 "2020-09-24T14:56:40Z")
What I have done so far input { elasticsearch { hosts =\> "localost" index =\> "employees\_data,transaction\_data" query =\> '{ "query": { "match": { "code": 1} } }' scroll =\> "5m" docinfo =\> true } } outp… --- ## [Forward elasticsearch log to external server](https://discuss.elastic.co/t/forward-elasticsearch-log-to-external-server/249785)
**Author:** [@borna\_talebi](https://discuss.elastic.co/u/borna_talebi)\ **Replies:** 3\ **Last updated:** [September 24, 2020, 2:55pm UTC](https://discuss.elastic.co/t/forward-elasticsearch-log-to-external-server/249785 "2020-09-24T14:55:08Z")
Hi, I know it's a rare use case but Is there any way to forward elasticsearch audit logs to another syslog server? all I find is this but it's deprecated. --- ## [If I enable xpack , Elasticsearch stops working and my license won't work](https://discuss.elastic.co/t/if-i-enable-xpack-elasticsearch-stops-working-and-my-license-wont-work/248690)
**Author:** [@cctk](https://discuss.elastic.co/u/cctk)\ **Replies:** 9\ **Last updated:** [September 24, 2020, 2:27pm UTC](https://discuss.elastic.co/t/if-i-enable-xpack-elasticsearch-stops-working-and-my-license-wont-work/248690 "2020-09-24T14:27:36Z")
I have been having an issue viewing the Kibana login page. Since the update to 7x for Elasticsearch and Kibana, I have not been able to access the login page nor has it been prompted for me. Is there any way that this ca… --- ## [ILM policy is changing without editing it](https://discuss.elastic.co/t/ilm-policy-is-changing-without-editing-it/249539)
**Author:** [@Abdelhalim](https://discuss.elastic.co/u/Abdelhalim)\ **Replies:** 2\ **Last updated:** [September 24, 2020, 2:24pm UTC](https://discuss.elastic.co/t/ilm-policy-is-changing-without-editing-it/249539 "2020-09-24T14:24:45Z")
Hello everybody, I created an ILM policy : PUT \_ilm/policy/hot-warm-cold-delete-60days-policy { "policy": { "phases": { "hot": { "actions": { "rollover": { "max\_size":"20gb", … --- ## [How do I build a branding plugin offline in kibana 7.9?](https://discuss.elastic.co/t/how-do-i-build-a-branding-plugin-offline-in-kibana-7-9/249549)
**Author:** [@Rhonda\_Gregory](https://discuss.elastic.co/u/Rhonda_Gregory)\ **Replies:** 2\ **Last updated:** [September 24, 2020, 2:22pm UTC](https://discuss.elastic.co/t/how-do-i-build-a-branding-plugin-offline-in-kibana-7-9/249549 "2020-09-24T14:22:14Z")
I created a plugin for Kibana 7.6.2 that's used to brand the UI, ie add a new logo and run some javascript to do some other customizations. Unfortunately, I'm also offline doing this so I'm not developing the plugin lev… --- ## [Filebeat googlecloud module not loading service account](https://discuss.elastic.co/t/filebeat-googlecloud-module-not-loading-service-account/248736)
**Author:** [@David\_Hurley](https://discuss.elastic.co/u/David_Hurley)\ **Replies:** 4\ **Last updated:** [September 24, 2020, 2:19pm UTC](https://discuss.elastic.co/t/filebeat-googlecloud-module-not-loading-service-account/248736 "2020-09-24T14:19:42Z")
I am running into an issue where filebeat is unable to load my gcp service account keyfile. This is my googlecloud config file - - module: googlecloud audit: enabled: true var.project\_id: my-proj… --- ## [Worker loop initialization error in logstash](https://discuss.elastic.co/t/worker-loop-initialization-error-in-logstash/248541)
**Author:** [@cp.patel](https://discuss.elastic.co/u/cp.patel)\ **Replies:** 7\ **Last updated:** [September 24, 2020, 2:08pm UTC](https://discuss.elastic.co/t/worker-loop-initialization-error-in-logstash/248541 "2020-09-24T14:08:27Z")
Hi, We are getting worker loop initialization error while starting logstash. Please help to rectify the issue. conf file is attached and also find the error logs. Error logs in logstash: \[2020-09-14T18:14:59,496\]\[ER… --- ## [Elastic search Index deleted](https://discuss.elastic.co/t/elastic-search-index-deleted/249817)
**Author:** [@kishorsekar](https://discuss.elastic.co/u/kishorsekar)\ **Replies:** 1\ **Last updated:** [September 24, 2020, 2:07pm UTC](https://discuss.elastic.co/t/elastic-search-index-deleted/249817 "2020-09-24T14:07:16Z")
Elastic search Index was mistakenly deleted. We used to take backup of each Index data in the server, how to recover it back. --- ## [Elasticsearh failing at 3am](https://discuss.elastic.co/t/elasticsearh-failing-at-3am/249824)
**Author:** [@paulherk](https://discuss.elastic.co/u/paulherk)\ **Replies:** 2\ **Last updated:** [September 24, 2020, 1:43pm UTC](https://discuss.elastic.co/t/elasticsearh-failing-at-3am/249824 "2020-09-24T13:43:46Z")
The last 2 nights at ~3am elasticsearch stops and kibana hangs. the message in /var/log/messages is Unable to retrieve version information from Elasticsearch nodes Any help would be greatly appreciated. --- ## [Using dissect dynamicly on filepath](https://discuss.elastic.co/t/using-dissect-dynamicly-on-filepath/249663)
**Author:** [@ThePreMan](https://discuss.elastic.co/u/ThePreMan)\ **Replies:** 4\ **Last updated:** [September 24, 2020, 1:45pm UTC](https://discuss.elastic.co/t/using-dissect-dynamicly-on-filepath/249663 "2020-09-24T13:45:55Z")
Hi. Im trying to setup a workflow where people can upload there log files onto a webserver and while doing so add tags to the log file for further differenciation. I was thinking of putting tags into the file name like f… --- ## [Painless in score context doesn't work with more\_like\_this query](https://discuss.elastic.co/t/painless-in-score-context-doesnt-work-with-more-like-this-query/249821)
**Author:** [@Sangmin\_Lee](https://discuss.elastic.co/u/Sangmin_Lee)\ **Replies:** 0\ **Last updated:** [September 24, 2020, 1:25pm UTC](https://discuss.elastic.co/t/painless-in-score-context-doesnt-work-with-more-like-this-query/249821 "2020-09-24T13:25:22Z")
Hi. To get a score of my query, I used this painless query below. But it doesn't work. GET \_scripts/painless/\_execute { "script": { "source": "\_score" }, "context": "score", "context\_se… --- ## [Implementing security on a live production stack](https://discuss.elastic.co/t/implementing-security-on-a-live-production-stack/249818)
**Author:** [@jfs1](https://discuss.elastic.co/u/jfs1)\ **Replies:** 0\ **Last updated:** [September 24, 2020, 1:02pm UTC](https://discuss.elastic.co/t/implementing-security-on-a-live-production-stack/249818 "2020-09-24T13:02:32Z")
I'm in the process of upgrading a (very) old stack. Now at version 6.8.12, I want to implement security. The issue is : it's a live, production system. It's ingesting 2.6K e/s and altough I have a little bit of spooling… --- ## [Add documentation Pipeline-to-Pipeline Communication](https://discuss.elastic.co/t/add-documentation-pipeline-to-pipeline-communication/249814)
**Author:** [@OlegMakarikhin](https://discuss.elastic.co/u/OlegMakarikhin)\ **Replies:** 0\ **Last updated:** [September 24, 2020, 12:41pm UTC](https://discuss.elastic.co/t/add-documentation-pipeline-to-pipeline-communication/249814 "2020-09-24T12:41:20Z")
Here is feature: https://www.elastic.co/guide/en/logstash/current/pipeline-to-pipeline.html But the logstash input-output plugins documentation does not describe these inputs and outputs. I made a mistake in the confi… --- ## [Convert HEx to ascii](https://discuss.elastic.co/t/convert-hex-to-ascii/249739)
**Author:** [@ThePreMan](https://discuss.elastic.co/u/ThePreMan)\ **Replies:** 1\ **Last updated:** [September 24, 2020, 12:34pm UTC](https://discuss.elastic.co/t/convert-hex-to-ascii/249739 "2020-09-24T12:34:41Z")
Hi again :slight\_smile: In my current Project we are using dlt-tools to convert dlt logs into ascii to be read by logstash. Our dlt viewer is using a specific plugin to convert some lines from hex to ascii. This is our … --- ## [Disable the automatic index template loading by logstash](https://discuss.elastic.co/t/disable-the-automatic-index-template-loading-by-logstash/249800)
**Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\ **Replies:** 2\ **Last updated:** [September 24, 2020, 12:27pm UTC](https://discuss.elastic.co/t/disable-the-automatic-index-template-loading-by-logstash/249800 "2020-09-24T12:27:42Z")
We are using logstash and when it starts it is loading the index template into elasticsearch. We want to disable the auto loading of the index template. --- ## [Docker logs in metrics](https://discuss.elastic.co/t/docker-logs-in-metrics/249556)
**Author:** [@Marta\_Zagrajek](https://discuss.elastic.co/u/Marta_Zagrajek)\ **Replies:** 2\ **Last updated:** [September 24, 2020, 12:25pm UTC](https://discuss.elastic.co/t/docker-logs-in-metrics/249556 "2020-09-24T12:25:29Z")
Hi there. I set up Metricbeat in my Rancher environment. I set it up with module docker so far. In tab metrics in kibana I can see metrics on docker containers but can not see logs, only this: docker.memory failed t… --- ## [What is the default edit distance for query\_string](https://discuss.elastic.co/t/what-is-the-default-edit-distance-for-query-string/249810)
**Author:** [@eclipse](https://discuss.elastic.co/u/eclipse)\ **Replies:** 0\ **Last updated:** [September 24, 2020, 12:22pm UTC](https://discuss.elastic.co/t/what-is-the-default-edit-distance-for-query-string/249810 "2020-09-24T12:22:11Z")
Hi, I wonder about the default edit distance of query\_string For a document containing quick, the following query { "query": { "query\_string": { "query": "quakc~2" } } } can return the docume… --- ## [Mongodb input to logstash output as elastic](https://discuss.elastic.co/t/mongodb-input-to-logstash-output-as-elastic/249806)
**Author:** [@Milan\_Suthar](https://discuss.elastic.co/u/Milan_Suthar)\ **Replies:** 0\ **Last updated:** [September 24, 2020, 12:05pm UTC](https://discuss.elastic.co/t/mongodb-input-to-logstash-output-as-elastic/249806 "2020-09-24T12:05:00Z")
i want MongoDB collections to insert into the elastic index I have tried but it has some issues as mentioned. is there any other standard way around? i have also tried JDBC input but also were facing issues , i fo… --- ## [Logstash adds too many fields / avoid fields from other tables](https://discuss.elastic.co/t/logstash-adds-too-many-fields-avoid-fields-from-other-tables/249802)
**Author:** [@llama0815](https://discuss.elastic.co/u/llama0815)\ **Replies:** 1\ **Last updated:** [September 24, 2020, 11:46am UTC](https://discuss.elastic.co/t/logstash-adds-too-many-fields-avoid-fields-from-other-tables/249802 "2020-09-24T11:46:08Z")
Hey guys, I'm using logstash and jdbc to import few tables. But all tables are running to the field limit (\>1000). I tried to import several other tables with several hundred columns (still each \<1000) but but they add… --- ## [Seeing 5 duplicate entries in kibana for each log entry](https://discuss.elastic.co/t/seeing-5-duplicate-entries-in-kibana-for-each-log-entry/249619)
**Author:** [@Ronnie16](https://discuss.elastic.co/u/Ronnie16)\ **Replies:** 2\ **Last updated:** [September 24, 2020, 11:21am UTC](https://discuss.elastic.co/t/seeing-5-duplicate-entries-in-kibana-for-each-log-entry/249619 "2020-09-24T11:21:23Z")
I have ELK cluster setup in which filebeat pulls the logs and sends to elasticsearch. The issue is that for each entry, the kibana shows exact 5 entries. Can someone point out the issue as to why this is happening ? H… --- ## [Elasticsearch - Design Question?](https://discuss.elastic.co/t/elasticsearch-design-question/248073)
**Author:** [@chintushah46](https://discuss.elastic.co/u/chintushah46)\ **Replies:** 9\ **Last updated:** [September 24, 2020, 11:18am UTC](https://discuss.elastic.co/t/elasticsearch-design-question/248073 "2020-09-24T11:18:00Z")
I want to migrate the data from SQL to Elasticsearch, but looking for some help. I am having 4 tables for each client and I am having 500+ such clients. How Can I achieve such design in Elasticsearch? --- ## [Scripting - How to find functions / methods in documentation of Elasticsearch](https://discuss.elastic.co/t/scripting-how-to-find-functions-methods-in-documentation-of-elasticsearch/249776)
**Author:** [@vasek](https://discuss.elastic.co/u/vasek)\ **Replies:** 8\ **Last updated:** [September 24, 2020, 10:52am UTC](https://discuss.elastic.co/t/scripting-how-to-find-functions-methods-in-documentation-of-elasticsearch/249776 "2020-09-24T10:52:24Z")
Hello, can anyone help me where I can find in documentation of Elasticsearch 7.x statements like: "".equals(ctx\['field'\]) or ctx\['field'\].empty or doc.containsKey('field.keyword')) --- ## [Redirecting problems in Stack Monitoring after changing to Metricbeat](https://discuss.elastic.co/t/redirecting-problems-in-stack-monitoring-after-changing-to-metricbeat/249788)
**Author:** [@peterol](https://discuss.elastic.co/u/peterol)\ **Replies:** 1\ **Last updated:** [September 24, 2020, 10:45am UTC](https://discuss.elastic.co/t/redirecting-problems-in-stack-monitoring-after-changing-to-metricbeat/249788 "2020-09-24T10:45:31Z")
Hello everyone! I have a redirecting problem with the stack monitoring: Until now I used the internal method for collecting monitoring data of my cluster, which worked fine. Now I want to use Metricbeat to collect data,… --- ## [Change Retention period](https://discuss.elastic.co/t/change-retention-period/249781)
**Author:** [@Giovanni\_Di\_Lembo](https://discuss.elastic.co/u/Giovanni_Di_Lembo)\ **Replies:** 1\ **Last updated:** [September 24, 2020, 10:12am UTC](https://discuss.elastic.co/t/change-retention-period/249781 "2020-09-24T10:12:32Z")
Hi there and sorry for my poor english. My question : is there a way to change retention time of data (if exists a way). --- ## [Lifecycle error](https://discuss.elastic.co/t/lifecycle-error/248987)
**Author:** [@Tuckson](https://discuss.elastic.co/u/Tuckson)\ **Replies:** 5\ **Last updated:** [September 24, 2020, 10:00am UTC](https://discuss.elastic.co/t/lifecycle-error/248987 "2020-09-24T10:00:07Z")
Hi, Getting a bit desperate of all things that go wrong. This time I bump into this lifecycle error. I really want to split indexes op since they grow to hundreds of Gb. But... Index lifecycle error illegal\_argument… --- ## [Getting manual preferred/weighted results](https://discuss.elastic.co/t/getting-manual-preferred-weighted-results/249766)
**Author:** [@peepdurple](https://discuss.elastic.co/u/peepdurple)\ **Replies:** 2\ **Last updated:** [September 24, 2020, 9:50am UTC](https://discuss.elastic.co/t/getting-manual-preferred-weighted-results/249766 "2020-09-24T09:50:40Z")
Hey there, I hope I'm in the right spot for my question. I'm currently facing an issue that I think is easier than I make it out to be and I need some input on that. We are consuming location data from several APIs, a… --- ## [Old evtx-File with winlogbeat read in](https://discuss.elastic.co/t/old-evtx-file-with-winlogbeat-read-in/249636)
**Author:** [@PatNae](https://discuss.elastic.co/u/PatNae)\ **Replies:** 2\ **Last updated:** [September 24, 2020, 9:44am UTC](https://discuss.elastic.co/t/old-evtx-file-with-winlogbeat-read-in/249636 "2020-09-24T09:44:43Z")
how can i read an old logfile with winlogbeat. I have seen the following: winlogbeat.event\_logs: name: ${EVTX\_FILE} no\_more\_events: stop But what exactly do I have to write in name/path? Where must my file be locate… --- ## [Yellow heath, Unassigned shards after restart](https://discuss.elastic.co/t/yellow-heath-unassigned-shards-after-restart/249775)
**Author:** [@Graham\_Smart](https://discuss.elastic.co/u/Graham_Smart)\ **Replies:** 6\ **Last updated:** [September 24, 2020, 9:22am UTC](https://discuss.elastic.co/t/yellow-heath-unassigned-shards-after-restart/249775 "2020-09-24T09:22:13Z")
Hi Guys, Im sure this is a simple one, but i cant seem to resolve. My ES node ran our of JVM space. So i modified its upper limit and restarted ES as ive done many times. This time round, it refuses to go Green. Its be… --- ## [Internal server error: /api/kibana/suggestions/values/Default](https://discuss.elastic.co/t/internal-server-error-api-kibana-suggestions-values-default/249725)
**Author:** [@aqiank](https://discuss.elastic.co/u/aqiank)\ **Replies:** 4\ **Last updated:** [September 24, 2020, 8:58am UTC](https://discuss.elastic.co/t/internal-server-error-api-kibana-suggestions-values-default/249725 "2020-09-24T08:58:09Z")
Hi, my Kibana instance seems to be encountering this internal server error from time to time. Does anyone know why? { "type": "error", "@timestamp": "2020-09-24T01:37:50Z", "tags": \[\], "pid": 846, "level": "er… --- ## [Filebeat pipeline for elasticsearch slowlog not indexing/parsing slowlog\_took (slowlog.duration)](https://discuss.elastic.co/t/filebeat-pipeline-for-elasticsearch-slowlog-not-indexing-parsing-slowlog-took-slowlog-duration/249777)
**Author:** [@Jiri\_Petak](https://discuss.elastic.co/u/Jiri_Petak)\ **Replies:** 0\ **Last updated:** [September 24, 2020, 8:57am UTC](https://discuss.elastic.co/t/filebeat-pipeline-for-elasticsearch-slowlog-not-indexing-parsing-slowlog-took-slowlog-duration/249777 "2020-09-24T08:57:57Z")
Hi, i have a question about filebeat elasticsearch module and it’s slowlog pipeline part. I found that in filebeat-7.7.0-elasticsearch-slowlog-pipeline-json which is default pipeline in fb 7.7.0 version, there is parse… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1786) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1788)