# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1795 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1796 --- ## [How can I search for word parts with operator AND](https://discuss.elastic.co/t/how-can-i-search-for-word-parts-with-operator-and/249342)
**Author:** [@MartinD](https://discuss.elastic.co/u/MartinD)\ **Replies:** 1\ **Last updated:** [September 21, 2020, 11:46am UTC](https://discuss.elastic.co/t/how-can-i-search-for-word-parts-with-operator-and/249342 "2020-09-21T11:46:26Z")
I have a field in my index which is using hyphenation decompounder for german. When I index a document with the value "Anfrage-7078437-991506 (1).P93" this leads to the tokens "Anfrage", "frage", "7078437", "991506", "1… --- ## [Tutorial for creating watcher scripts in Painless lab](https://discuss.elastic.co/t/tutorial-for-creating-watcher-scripts-in-painless-lab/248815)
**Author:** [@Babadofar](https://discuss.elastic.co/u/Babadofar)\ **Replies:** 2\ **Last updated:** [September 21, 2020, 11:16am UTC](https://discuss.elastic.co/t/tutorial-for-creating-watcher-scripts-in-painless-lab/248815 "2020-09-21T11:16:54Z")
Not sure where this question really belongs, but anyway. Creating complex alerts in watcher, using multi level aggregations and painless scripts for the condition is a little unwieldy. The Painless Lab could be used to… --- ## [Metricbeat System Dashboard not refreshing automatically](https://discuss.elastic.co/t/metricbeat-system-dashboard-not-refreshing-automatically/249338)
**Author:** [@pankaj0172](https://discuss.elastic.co/u/pankaj0172)\ **Replies:** 4\ **Last updated:** [September 21, 2020, 11:10am UTC](https://discuss.elastic.co/t/metricbeat-system-dashboard-not-refreshing-automatically/249338 "2020-09-21T11:10:02Z")
Hi, Can someone please help with me refreshing System Metricbeat Dashboard automatically as it's not refreshing automatically, I have to manually update every time to see the data. --- ## [Autodiscover kubernetes pod with multiple containers](https://discuss.elastic.co/t/autodiscover-kubernetes-pod-with-multiple-containers/248943)
**Author:** [@fridberg](https://discuss.elastic.co/u/fridberg)\ **Replies:** 2\ **Last updated:** [September 21, 2020, 10:54am UTC](https://discuss.elastic.co/t/autodiscover-kubernetes-pod-with-multiple-containers/248943 "2020-09-21T10:54:21Z")
I have been trying to use the autodiscover kubernetes provider to retrieve metrics from prometheus endpoints on my pods. In each pod there is also a cloudsql-proxy container, which should not be scraped. The problem here… --- ## [Cluster RED, unassigned shards](https://discuss.elastic.co/t/cluster-red-unassigned-shards/248951)
**Author:** [@alkarp](https://discuss.elastic.co/u/alkarp)\ **Replies:** 3\ **Last updated:** [September 21, 2020, 10:42am UTC](https://discuss.elastic.co/t/cluster-red-unassigned-shards/248951 "2020-09-21T10:42:02Z")
After complete cluster restart have all the indices shards unassigned. 662 indices 820 shards in summary 3 master nodes 3 data nodes Master and data nodes are up, and it says "can\_allocate" : "yes", however shards s… --- ## [Ping remote services for availability and log results to Elasticsearch or send to Logstash](https://discuss.elastic.co/t/ping-remote-services-for-availability-and-log-results-to-elasticsearch-or-send-to-logstash/249273)
**Author:** [@Armen\_Khachikyan](https://discuss.elastic.co/u/Armen_Khachikyan)\ **Replies:** 2\ **Last updated:** [September 21, 2020, 10:09am UTC](https://discuss.elastic.co/t/ping-remote-services-for-availability-and-log-results-to-elasticsearch-or-send-to-logstash/249273 "2020-09-21T10:09:44Z")
have ELK server, and sending Heartbeats to server. I added an monitor in monitors.d directory, added setup.dashboards.enabled: true line in heartbeat.yml file, but after restarting heartbeat service, service working 2-… --- ## [Logstash - Symantec Pipeline](https://discuss.elastic.co/t/logstash-symantec-pipeline/249334)
**Author:** [@amolmegheELK](https://discuss.elastic.co/u/amolmegheELK)\ **Replies:** 0\ **Last updated:** [September 21, 2020, 9:55am UTC](https://discuss.elastic.co/t/logstash-symantec-pipeline/249334 "2020-09-21T09:55:36Z")
Hello, I am using ELK 6.8.0, and i am performing the logstash Pipeline for symantec. earlier indices created as per pipeline and our custom requirements . however newly created indices is different from old one. Older i… --- ## [I need help: Search query for single custom object array with words and values sorted decending](https://discuss.elastic.co/t/i-need-help-search-query-for-single-custom-object-array-with-words-and-values-sorted-decending/249333)
**Author:** [@prox](https://discuss.elastic.co/u/prox)\ **Replies:** 0\ **Last updated:** [September 21, 2020, 9:54am UTC](https://discuss.elastic.co/t/i-need-help-search-query-for-single-custom-object-array-with-words-and-values-sorted-decending/249333 "2020-09-21T09:54:42Z")
I am currently troubled by creating an elasticsearch query that searches firstly the "customPayload", sort by the word value. It is currently enough if it only works with single word search terms. If possible I also want… --- ## [How to get the ctx.payload.hits.hits after aggregation and transform (Watcher)](https://discuss.elastic.co/t/how-to-get-the-ctx-payload-hits-hits-after-aggregation-and-transform-watcher/249045)
**Author:** [@Karrie\_Koo](https://discuss.elastic.co/u/Karrie_Koo)\ **Replies:** 1\ **Last updated:** [September 21, 2020, 9:49am UTC](https://discuss.elastic.co/t/how-to-get-the-ctx-payload-hits-hits-after-aggregation-and-transform-watcher/249045 "2020-09-21T09:49:46Z")
cannot get {{ctx.payload.hits.hits.0.beats\_state.beat.host}} this field "subject": "{{ctx.payload.hits.hits.0.beats\_state.beat.host}} WARNING: Filebeat is down and unavilable \[No. of Filebeat down: {{ctx.payload.\_v… --- ## [Replace string in a string field (Ingest Pipeline)](https://discuss.elastic.co/t/replace-string-in-a-string-field-ingest-pipeline/248553)
**Author:** [@BkQc](https://discuss.elastic.co/u/BkQc)\ **Replies:** 3\ **Last updated:** [September 21, 2020, 9:47am UTC](https://discuss.elastic.co/t/replace-string-in-a-string-field-ingest-pipeline/248553 "2020-09-21T09:47:32Z")
I have a field for which I would need to replace values by CrLf. I tried the following but \\r\\n is not recognized (unexpected character \[\\"\\\\r\]. The only valid escape sequences in strings starting with \[\\"\] a… --- ## [Grok Multiline file](https://discuss.elastic.co/t/grok-multiline-file/248302)
**Author:** [@LuigiDelavega](https://discuss.elastic.co/u/LuigiDelavega)\ **Replies:** 4\ **Last updated:** [September 11, 2020, 2:57pm UTC](https://discuss.elastic.co/t/grok-multiline-file/248302 "2020-09-11T14:57:28Z")
Hi there, I'm looking to grok mails which were not sent. So i would like the entire file to be read as one log with 5 fields : From, To, Date, Subject and the rest as Message. Here is what it looks like: From: TEXT To… --- ## [Unable to Disable G1 GC logging to stdout RHEL6](https://discuss.elastic.co/t/unable-to-disable-g1-gc-logging-to-stdout-rhel6/247291)
**Author:** [@lzukel](https://discuss.elastic.co/u/lzukel)\ **Replies:** 5\ **Last updated:** [September 21, 2020, 9:44am UTC](https://discuss.elastic.co/t/unable-to-disable-g1-gc-logging-to-stdout-rhel6/247291 "2020-09-21T09:44:20Z")
I am unable to disable the GC logging from Elasticsearch 7.x to stdout. elasticsearch startup command: /usr/share/elasticsearch/jdk//bin/java -Xshare:auto -Des.networkaddress.cache.ttl=60 -Des.networkaddress.cache.nega… --- ## [Hide Management Feature](https://discuss.elastic.co/t/hide-management-feature/246371)
**Author:** [@AClerk](https://discuss.elastic.co/u/AClerk)\ **Replies:** 5\ **Last updated:** [September 21, 2020, 9:35am UTC](https://discuss.elastic.co/t/hide-management-feature/246371 "2020-09-21T09:35:55Z")
Hello, I have created a role that has access to a specific space, in that space, I want to give access to the canvas feature only. When I login with that user, I can see the management feature (gear icon). I followed t… --- ## [Question about ILM](https://discuss.elastic.co/t/question-about-ilm/249234)
**Author:** [@borna\_talebi](https://discuss.elastic.co/u/borna_talebi)\ **Replies:** 6\ **Last updated:** [September 21, 2020, 9:17am UTC](https://discuss.elastic.co/t/question-about-ilm/249234 "2020-09-21T09:17:17Z")
Hi, I'm using a custom index in my filebeat so I had to disable ilm in elasticsearch. My question is if there is a automatic solution to delete indices older than 3 months when ilm is diabled? or maybe have a hot-cold … --- ## [How to chose the number of shards and replica](https://discuss.elastic.co/t/how-to-chose-the-number-of-shards-and-replica/249321)
**Author:** [@Abdelhalim](https://discuss.elastic.co/u/Abdelhalim)\ **Replies:** 2\ **Last updated:** [September 21, 2020, 8:25am UTC](https://discuss.elastic.co/t/how-to-chose-the-number-of-shards-and-replica/249321 "2020-09-21T08:25:47Z")
Hello everybody, Could you tell me please what is the best rule to calculate the number of shards for the index ? I found this rule but I don't know if it's the best one: 20 Shards max for each 1 GB of heap on each nod… --- ## [Elastic Cloud. Different deployments. Titles](https://discuss.elastic.co/t/elastic-cloud-different-deployments-titles/247823)
**Author:** [@xhidalgo](https://discuss.elastic.co/u/xhidalgo)\ **Replies:** 3\ **Last updated:** [September 21, 2020, 8:15am UTC](https://discuss.elastic.co/t/elastic-cloud-different-deployments-titles/247823 "2020-09-21T08:15:11Z")
Hi, we are using Elastic Cloud to administer different deployments for different clients. We use it and have opened more than one windows at a time and it's easy to loose control on what client we are working on.. It wo… --- ## [How to convert default index template from 5.6 to 7.9?](https://discuss.elastic.co/t/how-to-convert-default-index-template-from-5-6-to-7-9/249112)
**Author:** [@jze](https://discuss.elastic.co/u/jze)\ **Replies:** 3\ **Last updated:** [September 21, 2020, 8:10am UTC](https://discuss.elastic.co/t/how-to-convert-default-index-template-from-5-6-to-7-9/249112 "2020-09-21T08:10:00Z")
Hello, I have from ELK 5.6 stack this default index template definition: PUT /\_template/mytemplate { "template":".kibana-\*", "settings":{ "number\_of\_shards":1 }, "mappings":{ "config":{ … --- ## [Bulk API "lies" in the response](https://discuss.elastic.co/t/bulk-api-lies-in-the-response/248674)
**Author:** [@JulGor](https://discuss.elastic.co/u/JulGor)\ **Replies:** 7\ **Last updated:** [September 21, 2020, 7:53am UTC](https://discuss.elastic.co/t/bulk-api-lies-in-the-response/248674 "2020-09-21T07:53:28Z")
Hello, I'm having some problems using the Bulk API because it is lying in the response it returns. I'm using the following request: POST /\_bulk?refresh=true { "index": { "\_index": "my\_index", "\_id": 123 } }, … --- ## [Problem implementing EuiSearchBar, cannot create queries with multiple boolean operators](https://discuss.elastic.co/t/problem-implementing-euisearchbar-cannot-create-queries-with-multiple-boolean-operators/248112)
**Author:** [@K\_Chaitanya](https://discuss.elastic.co/u/K_Chaitanya)\ **Replies:** 6\ **Last updated:** [September 21, 2020, 7:33am UTC](https://discuss.elastic.co/t/problem-implementing-euisearchbar-cannot-create-queries-with-multiple-boolean-operators/248112 "2020-09-21T07:33:22Z")
I am trying to create a Kibana plugin, where I need do search on entire page, similar to that of search in Discover app. But query formed using the EuiSearchBar from elastic eui components I have the following setup im… --- ## [Filebeat - unknown index name/nginx log formatting](https://discuss.elastic.co/t/filebeat-unknown-index-name-nginx-log-formatting/248828)
**Author:** [@vinci](https://discuss.elastic.co/u/vinci)\ **Replies:** 3\ **Last updated:** [September 21, 2020, 7:28am UTC](https://discuss.elastic.co/t/filebeat-unknown-index-name-nginx-log-formatting/248828 "2020-09-21T07:28:59Z")
Hello, I have the following configuration file for filebeat: # filebeat.yml for harvesting docker logfiles #=========================== Filebeat inputs ============================= filebeat.inputs: - t… --- ## [Transform invalid date values](https://discuss.elastic.co/t/transform-invalid-date-values/249308)
**Author:** [@liorg2](https://discuss.elastic.co/u/liorg2)\ **Replies:** 1\ **Last updated:** [September 21, 2020, 7:26am UTC](https://discuss.elastic.co/t/transform-invalid-date-values/249308 "2020-09-21T07:26:20Z")
Hello, I have the following group by in my transform: "pivot": { "group\_by": { "datetime": { "date\_histogram": { "field": "datetime", "calendar\_interval": "1m" } }, … --- ## [How to get sample data which is used in demo.elastic.co?](https://discuss.elastic.co/t/how-to-get-sample-data-which-is-used-in-demo-elastic-co/249247)
**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\ **Replies:** 2\ **Last updated:** [September 21, 2020, 6:55am UTC](https://discuss.elastic.co/t/how-to-get-sample-data-which-is-used-in-demo-elastic-co/249247 "2020-09-21T06:55:57Z")
hi We could see the demo.elastic.co has quite good dataset to simulate SIEM/APM etc. eg. https://demo.elastic.co/app/siem#/detections/signals Would like to understand How to get hold of these sample data? Is it ope… --- ## [Kibana Transform index using terms aggregation](https://discuss.elastic.co/t/kibana-transform-index-using-terms-aggregation/249122)
**Author:** [@geekganesh](https://discuss.elastic.co/u/geekganesh)\ **Replies:** 2\ **Last updated:** [September 21, 2020, 6:49am UTC](https://discuss.elastic.co/t/kibana-transform-index-using-terms-aggregation/249122 "2020-09-21T06:49:11Z")
I am using Elastic Cloud v 7.5.2. I am trying to transform the index, where i want the term count to be aggregated. In Kibana UI, Define Pivot does not have provision to take terms aggregation. How to achieve it? Is the … --- ## [Rolling upgrade - can't revert... :-(](https://discuss.elastic.co/t/rolling-upgrade-cant-revert/249306)
**Author:** [@HarelM](https://discuss.elastic.co/u/HarelM)\ **Replies:** 2\ **Last updated:** [September 21, 2020, 6:28am UTC](https://discuss.elastic.co/t/rolling-upgrade-cant-revert/249306 "2020-09-21T06:28:39Z")
OK, so I started an attempt to upgrade my elasticsearch node. I had one node with 5.6.3 version and a few indices. I added another node with version 6.8.12. I Reindexed all my indices and added a prefix 6-8 so that ne… --- ## [Tracking Sales Against Goals](https://discuss.elastic.co/t/tracking-sales-against-goals/249047)
**Author:** [@mykael](https://discuss.elastic.co/u/mykael)\ **Replies:** 3\ **Last updated:** [September 21, 2020, 5:47am UTC](https://discuss.elastic.co/t/tracking-sales-against-goals/249047 "2020-09-21T05:47:47Z")
I'm looking for suggestions on how to handle this in Kibana. I've got one index that contains sales goals. Each record has a state, a month and a slaes goal for that month. Say, In WA, in August, we want to sell 600 i… --- ## [Split message field into multiple fields in kibana](https://discuss.elastic.co/t/split-message-field-into-multiple-fields-in-kibana/249262)
**Author:** [@chand](https://discuss.elastic.co/u/chand)\ **Replies:** 4\ **Last updated:** [September 21, 2020, 5:39am UTC](https://discuss.elastic.co/t/split-message-field-into-multiple-fields-in-kibana/249262 "2020-09-21T05:39:05Z")
I've the following data for the message field which is being shipped by filebeat to elasticseatch. I am not using Logstash here 2020-09-20 15:44:23 ::1 get / - 80 - ::1 mozilla/5.0+(windows+nt+10.0;+win64;+x64)+window… --- ## [Kibana how to export csv](https://discuss.elastic.co/t/kibana-how-to-export-csv/249298)
**Author:** [@111387](https://discuss.elastic.co/u/111387)\ **Replies:** 1\ **Last updated:** [September 21, 2020, 5:33am UTC](https://discuss.elastic.co/t/kibana-how-to-export-csv/249298 "2020-09-21T05:33:52Z")
i installed kibana and recevied data using logstash i want to export data to csv but share-\> csv reports -\> generate csv button is disabled.. kibana version is 7.9 and license is basic basic license can't using export… --- ## [Template index\_pattern matching](https://discuss.elastic.co/t/template-index-pattern-matching/249289)
**Author:** [@szanin](https://discuss.elastic.co/u/szanin)\ **Replies:** 2\ **Last updated:** [September 21, 2020, 4:02am UTC](https://discuss.elastic.co/t/template-index-pattern-matching/249289 "2020-09-21T04:02:53Z")
How do I ensure that only new indices get my template, and not the metrics or logs indices. If I define the "index\_pattern" to be "\*" that will apply to all new indices. Is there a way to specify that I don't want to app… --- ## [Kibana redirect to page: Select your space after a day, all data is reset. (ver: 7.8.0)](https://discuss.elastic.co/t/kibana-redirect-to-page-select-your-space-after-a-day-all-data-is-reset-ver-7-8-0/245908)
**Author:** [@lucky\_luke15190](https://discuss.elastic.co/u/lucky_luke15190)\ **Replies:** 5\ **Last updated:** [September 21, 2020, 3:59am UTC](https://discuss.elastic.co/t/kibana-redirect-to-page-select-your-space-after-a-day-all-data-is-reset-ver-7-8-0/245908 "2020-09-21T03:59:50Z")
I have built kibana with elasticsearch and filebeat, it's running well with filebeat default index, own dashboard. After 1 day, it redirect to page: Select your space, no spaces match search criteria. This can be fixed… --- ## [Defining index mappings on ElasticSearch](https://discuss.elastic.co/t/defining-index-mappings-on-elasticsearch/248774)
**Author:** [@szanin](https://discuss.elastic.co/u/szanin)\ **Replies:** 5\ **Last updated:** [September 21, 2020, 3:32am UTC](https://discuss.elastic.co/t/defining-index-mappings-on-elasticsearch/248774 "2020-09-21T03:32:18Z")
Hi there, This is my first post here, so I apologise in advance if I'm not too clear or if my question has been asked already. I have ElasticSearch running in a Docker cluster, I use it to search through a ASP.NET core… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1794) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1796)