# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1857 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1858 --- ## [Elasticsearch Index Management - Index Lifecycle Policies](https://discuss.elastic.co/t/elasticsearch-index-management-index-lifecycle-policies/244221)
**Author:** [@brettlarsonwci](https://discuss.elastic.co/u/brettlarsonwci)\ **Replies:** 2\ **Last updated:** [August 19, 2020, 5:22am UTC](https://discuss.elastic.co/t/elasticsearch-index-management-index-lifecycle-policies/244221 "2020-08-19T05:22:25Z")
Hello All - I am currently trying to set up some lifecycle policy's to clean up indices. In Kibana, I have an index pattern of "logstash-\*". Fluentd is just taking everything matching that pattern and sending it. This c… --- ## [Logstash + Elasticsearch Architecture Tips](https://discuss.elastic.co/t/logstash-elasticsearch-architecture-tips/245490)
**Author:** [@sergle](https://discuss.elastic.co/u/sergle)\ **Replies:** 2\ **Last updated:** [August 19, 2020, 5:13am UTC](https://discuss.elastic.co/t/logstash-elasticsearch-architecture-tips/245490 "2020-08-19T05:13:18Z")
Hey, very new to LS and ES, and ELK in general so while I am setting up my system I have a few questions regarding the advised architecture and looking for recommendations and tips for best implementation/use. The plan … --- ## [What is the use of advanced settings of previous kibana versions under saved objects of kibana 7.8.0?](https://discuss.elastic.co/t/what-is-the-use-of-advanced-settings-of-previous-kibana-versions-under-saved-objects-of-kibana-7-8-0/245154)
**Author:** [@shivani\_aggarwal](https://discuss.elastic.co/u/shivani_aggarwal)\ **Replies:** 2\ **Last updated:** [August 19, 2020, 4:41am UTC](https://discuss.elastic.co/t/what-is-the-use-of-advanced-settings-of-previous-kibana-versions-under-saved-objects-of-kibana-7-8-0/245154 "2020-08-19T04:41:56Z")
Hi, I was using ELK 6.6.1 stack in k8s environment (having some index patterns saved in kibana index - .kibana\_1) and then upgraded to 7.0.1 (oss) stack. Due to this, the saved objects got migrated to .kibana\_2. Some n… --- ## [Logstash Add Extra Space on a particular field based on the config](https://discuss.elastic.co/t/logstash-add-extra-space-on-a-particular-field-based-on-the-config/245520)
**Author:** [@mastersmit](https://discuss.elastic.co/u/mastersmit)\ **Replies:** 0\ **Last updated:** [August 19, 2020, 4:29am UTC](https://discuss.elastic.co/t/logstash-add-extra-space-on-a-particular-field-based-on-the-config/245520 "2020-08-19T04:29:01Z")
I have a particular requirement where I have extracted out a field based on the GROK patterns. And based on the length of the attribute, i have to add space at the end of the string. For example: Attribute: PartA: tes… --- ## [Slow Indexing speed / Bottleneck](https://discuss.elastic.co/t/slow-indexing-speed-bottleneck/245378)
**Author:** [@Anirbaan\_Chowdhury](https://discuss.elastic.co/u/Anirbaan_Chowdhury)\ **Replies:** 5\ **Last updated:** [August 19, 2020, 3:49am UTC](https://discuss.elastic.co/t/slow-indexing-speed-bottleneck/245378 "2020-08-19T03:49:23Z")
Hi Experts, I know there are many threads opened for this but I haven't been able to fix my issue with them. I am new to this. In our ES cluster, there are 4 data, 1 master and 1 ingest nodes. The index rate is curre… --- ## [Elasticsearch](https://discuss.elastic.co/t/elasticsearch/245461)
**Author:** [@Ben\_said](https://discuss.elastic.co/u/Ben_said)\ **Replies:** 1\ **Last updated:** [August 19, 2020, 3:47am UTC](https://discuss.elastic.co/t/elasticsearch/245461 "2020-08-19T03:47:35Z")
can someone help me please ? i try to set fileddata to true but its failed. { "took": 26, "timed\_out": false, "\_shards": { "total": 2, "successful": 1, "skipped": 1, "failed": 1, "failures": \[ { "shard": 0, … --- ## [How to filter the scan scope of containers.paths](https://discuss.elastic.co/t/how-to-filter-the-scan-scope-of-containers-paths/245518)
**Author:** [@wajika](https://discuss.elastic.co/u/wajika)\ **Replies:** 0\ **Last updated:** [August 19, 2020, 3:15am UTC](https://discuss.elastic.co/t/how-to-filter-the-scan-scope-of-containers-paths/245518 "2020-08-19T03:15:54Z")
I only want to collect the directories at the beginning of back and front, how should I set the filter? filebeat.inputs: type: container paths: "/var/log/pods///\*.log" stream: "all" processors: add\_host\_me… --- ## [How retain certain index for more time than the other?](https://discuss.elastic.co/t/how-retain-certain-index-for-more-time-than-the-other/245469)
**Author:** [@srbhklkrn](https://discuss.elastic.co/u/srbhklkrn)\ **Replies:** 7\ **Last updated:** [August 19, 2020, 3:22am UTC](https://discuss.elastic.co/t/how-retain-certain-index-for-more-time-than-the-other/245469 "2020-08-19T03:22:44Z")
I'm on Elasticsearch 6.4, I have 4 indexes out of which for 2 I need to set the retention period to be 60 days, how do I set that? --- ## [Do we have a light weight Kibana?](https://discuss.elastic.co/t/do-we-have-a-light-weight-kibana/245070)
**Author:** [@Charele](https://discuss.elastic.co/u/Charele)\ **Replies:** 2\ **Last updated:** [August 19, 2020, 2:45am UTC](https://discuss.elastic.co/t/do-we-have-a-light-weight-kibana/245070 "2020-08-19T02:45:15Z")
When I run Kibana,it will create many indeces on my cluster, ilm-history-2-000001 .kibana\_task\_manager\_1 .kibana\_1 .kibana-event-log-7.8.1-000001 .apm-custom-link .apm-agent-configuration... These indices are unne… --- ## [Need to do sum aggregation with probable null values of field](https://discuss.elastic.co/t/need-to-do-sum-aggregation-with-probable-null-values-of-field/245373)
**Author:** [@\_ite\_iew](https://discuss.elastic.co/u/_ite_iew)\ **Replies:** 0\ **Last updated:** [August 18, 2020, 8:21am UTC](https://discuss.elastic.co/t/need-to-do-sum-aggregation-with-probable-null-values-of-field/245373 "2020-08-18T08:21:26Z")
Hi, I have a field in my elastic index with a probable null value for that field. But when I do sum aggregation on that field, even with all the values as null it returns 0 as the value from elasticsearch. I need to h… --- ## [Unable to complete the url kibana](https://discuss.elastic.co/t/unable-to-complete-the-url-kibana/245513)
**Author:** [@z018782](https://discuss.elastic.co/u/z018782)\ **Replies:** 2\ **Last updated:** [August 19, 2020, 2:09am UTC](https://discuss.elastic.co/t/unable-to-complete-the-url-kibana/245513 "2020-08-19T02:09:10Z")
When reloading the same URL, i am getting this error. Kibana Version : 6.8.1 --- ## [Fundamental of securing elastic search |why self signed certificate is failing while querying using curl](https://discuss.elastic.co/t/fundamental-of-securing-elastic-search-why-self-signed-certificate-is-failing-while-querying-using-curl/245325)
**Author:** [@manojb1-in.ibm.com](https://discuss.elastic.co/u/manojb1-in.ibm.com)\ **Replies:** 1\ **Last updated:** [August 19, 2020, 1:59am UTC](https://discuss.elastic.co/t/fundamental-of-securing-elastic-search-why-self-signed-certificate-is-failing-while-querying-using-curl/245325 "2020-08-19T01:59:35Z")
using "elasticsearch-certutil" I created ca file and the p12 certificates. I could query the elasticsearch ip using curl in insecure mode (using -k) option But querying is not working when specify the path of cacert! Wh… --- ## [How not to output a matching field in grok pattern?](https://discuss.elastic.co/t/how-not-to-output-a-matching-field-in-grok-pattern/245435)
**Author:** [@Tristan\_D](https://discuss.elastic.co/u/Tristan_D)\ **Replies:** 2\ **Last updated:** [August 19, 2020, 1:25am UTC](https://discuss.elastic.co/t/how-not-to-output-a-matching-field-in-grok-pattern/245435 "2020-08-19T01:25:28Z")
I don't want the mathed http\_version field in the output. How should I to do avoid it? I can't remove it with the non-caputering group symbol. This is my nginx log 10.102.136.44 - - \[26/Nov/2019:19:49:36 +0800\] "POST … --- ## [Time based rollover vs Time based routing](https://discuss.elastic.co/t/time-based-rollover-vs-time-based-routing/245509)
**Author:** [@joropito](https://discuss.elastic.co/u/joropito)\ **Replies:** 1\ **Last updated:** [August 19, 2020, 12:20am UTC](https://discuss.elastic.co/t/time-based-rollover-vs-time-based-routing/245509 "2020-08-19T00:20:10Z")
Hi everyone I wonder what's better in my use case. A single large index, a time based rollover (monthly maybe) or a time based (monthly) shard routing? The case 10million documents each month (daily ingestion). Some of… --- ## [Kibana or Painless Script read from file](https://discuss.elastic.co/t/kibana-or-painless-script-read-from-file/245507)
**Author:** [@lakechat](https://discuss.elastic.co/u/lakechat)\ **Replies:** 1\ **Last updated:** [August 19, 2020, 12:04am UTC](https://discuss.elastic.co/t/kibana-or-painless-script-read-from-file/245507 "2020-08-19T00:04:30Z")
Does Kibana or Painless Script have functions that can read input from files to filter out events in current index? Splunk has inputlookup and lookup to do this. --- ## [Performance characteristics and implementation details of context/completion suggester](https://discuss.elastic.co/t/performance-characteristics-and-implementation-details-of-context-completion-suggester/245508)
**Author:** [@Srinivasan\_Ramaswamy](https://discuss.elastic.co/u/Srinivasan_Ramaswamy)\ **Replies:** 0\ **Last updated:** [August 18, 2020, 11:58pm UTC](https://discuss.elastic.co/t/performance-characteristics-and-implementation-details-of-context-completion-suggester/245508 "2020-08-18T23:58:03Z")
Hi Everyone I would like to understand the performance characteristics of context suggester. I am planning to use completion suggester for a very big index (billions of documents - but only for few fields). the field is… --- ## [Filebeat relay](https://discuss.elastic.co/t/filebeat-relay/245504)
**Author:** [@astateofmind](https://discuss.elastic.co/u/astateofmind)\ **Replies:** 0\ **Last updated:** [August 18, 2020, 11:12pm UTC](https://discuss.elastic.co/t/filebeat-relay/245504 "2020-08-18T23:12:40Z")
So, i'm trying to do something ... weird. Filebeat01 - \> filebeat02-\> logstash. On filebeat01 i enabled logstash output with filbeat02 as target and on filebeat02 tcp input. The json from the first filebat is encapulta… --- ## [How to made logstash work with io.confluent.kafka.serializers.KafkaAvroSerializer](https://discuss.elastic.co/t/how-to-made-logstash-work-with-io-confluent-kafka-serializers-kafkaavroserializer/245503)
**Author:** [@wysouf](https://discuss.elastic.co/u/wysouf)\ **Replies:** 0\ **Last updated:** [August 18, 2020, 10:57pm UTC](https://discuss.elastic.co/t/how-to-made-logstash-work-with-io-confluent-kafka-serializers-kafkaavroserializer/245503 "2020-08-18T22:57:36Z")
output{ kafka{ topic\_id =\> "myTopic" bootstrap\_servers =\> "127.0.0.1:9092" value\_serializer =\> "io.confluent.kafka.serializers.KafkaAvroSerializer" } } \[\[main\]-pipeline-manager\] kafka - Unable to cr… --- ## [Running cURL commands from desktop to access ES on AWS](https://discuss.elastic.co/t/running-curl-commands-from-desktop-to-access-es-on-aws/245501)
**Author:** [@mikedee](https://discuss.elastic.co/u/mikedee)\ **Replies:** 1\ **Last updated:** [August 18, 2020, 10:46pm UTC](https://discuss.elastic.co/t/running-curl-commands-from-desktop-to-access-es-on-aws/245501 "2020-08-18T22:46:26Z")
I am trying to run a scheduled cron job with a cURL command from my desktop terminal, however, when I run the command it returns this error: "curl: (7) Failed to connect to localhost port 9200: Connection refused". We a… --- ## [ElasticSearch: Logic to alert based on dynamic threshold specified in a csv file](https://discuss.elastic.co/t/elasticsearch-logic-to-alert-based-on-dynamic-threshold-specified-in-a-csv-file/245449)
**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\ **Replies:** 1\ **Last updated:** [August 18, 2020, 9:49pm UTC](https://discuss.elastic.co/t/elasticsearch-logic-to-alert-based-on-dynamic-threshold-specified-in-a-csv-file/245449 "2020-08-18T21:49:23Z")
folks, I've got a requirement, Get error codes from raw data within a particular time period if the count of error codes is greater than count specified in a lookup/csv list, then alert I understand there is NO looku… --- ## [How to do summary indexing in Elasticsearch](https://discuss.elastic.co/t/how-to-do-summary-indexing-in-elasticsearch/245491)
**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\ **Replies:** 6\ **Last updated:** [August 18, 2020, 9:45pm UTC](https://discuss.elastic.co/t/how-to-do-summary-indexing-in-elasticsearch/245491 "2020-08-18T21:45:08Z")
hi, we have a massive index, few reference indexes and we wanted to summarise from these multiple indexes into a single "summary index" . This way we are planning to join the queries So the questions Can output of a … --- ## [How to server.plugins.xpack\_main.registerFeature on the new platform?](https://discuss.elastic.co/t/how-to-server-plugins-xpack-main-registerfeature-on-the-new-platform/245493)
**Author:** [@npm\_install](https://discuss.elastic.co/u/npm_install)\ **Replies:** 1\ **Last updated:** [August 18, 2020, 9:31pm UTC](https://discuss.elastic.co/t/how-to-server-plugins-xpack-main-registerfeature-on-the-new-platform/245493 "2020-08-18T21:31:55Z")
Hi, I have created a basic plugin using the plugin generator, and I have been reading documentation about different legacy functionality and the new platform equivalents. However, I cannot find an example of how to regi… --- ## [Skip Scoring more than once if search term appears multiple time in Document](https://discuss.elastic.co/t/skip-scoring-more-than-once-if-search-term-appears-multiple-time-in-document/245399)
**Author:** [@AmitaS](https://discuss.elastic.co/u/AmitaS)\ **Replies:** 1\ **Last updated:** [August 18, 2020, 9:23pm UTC](https://discuss.elastic.co/t/skip-scoring-more-than-once-if-search-term-appears-multiple-time-in-document/245399 "2020-08-18T21:23:02Z")
HI Is it possible not to increase score if the search term appears in document more than once? to implement similar to this ,which is implemented on db int rank = 100; var isMatched = false; … --- ## [Sort by country with one specific country first](https://discuss.elastic.co/t/sort-by-country-with-one-specific-country-first/245100)
**Author:** [@steff7](https://discuss.elastic.co/u/steff7)\ **Replies:** 2\ **Last updated:** [August 18, 2020, 9:20pm UTC](https://discuss.elastic.co/t/sort-by-country-with-one-specific-country-first/245100 "2020-08-18T21:20:48Z")
Hello, I am new to Elastic and I am trying to get a list of products. My bool query works in general but now i want to solve the following sorting problem. The multilanguage website shows products of different countrie… --- ## [Logstash cloudwatch output plugin configuration](https://discuss.elastic.co/t/logstash-cloudwatch-output-plugin-configuration/245495)
**Author:** [@timragon](https://discuss.elastic.co/u/timragon)\ **Replies:** 0\ **Last updated:** [August 18, 2020, 9:16pm UTC](https://discuss.elastic.co/t/logstash-cloudwatch-output-plugin-configuration/245495 "2020-08-18T21:16:23Z")
We are trying to configure CloudWatch Output Plugin. We are able to add "access\_key\_id" =\> "" "secret\_access\_key" =\> "" "region" =\> "" in logstash configuration file. Could you please guide how to set CloudWatch log… --- ## [Kibana Charts Into PowerPoint](https://discuss.elastic.co/t/kibana-charts-into-powerpoint/245406)
**Author:** [@vignesh23041991](https://discuss.elastic.co/u/vignesh23041991)\ **Replies:** 1\ **Last updated:** [August 18, 2020, 9:08pm UTC](https://discuss.elastic.co/t/kibana-charts-into-powerpoint/245406 "2020-08-18T21:08:16Z")
We have options to Copy Chart From Excel To PowerPoint Using VBA so similarly do we have any options in Kibana to import the chart in power point . --- ## [Kibana7.6.1 yarn kbn bootstrap failed](https://discuss.elastic.co/t/kibana7-6-1-yarn-kbn-bootstrap-failed/245438)
**Author:** [@SKumarMN](https://discuss.elastic.co/u/SKumarMN)\ **Replies:** 1\ **Last updated:** [August 18, 2020, 9:06pm UTC](https://discuss.elastic.co/t/kibana7-6-1-yarn-kbn-bootstrap-failed/245438 "2020-08-18T21:06:21Z")
Hi When i try to do "yarn kbn bootstrap" i am getting the below error. I tried both yarn kbn clean and yarn cache clean still the issue persists. Any help to resolve this yarn version v1.22.4 Linking executables comp… --- ## [Kibana - OSS 7.8.0 logo change](https://discuss.elastic.co/t/kibana-oss-7-8-0-logo-change/245306)
**Author:** [@utkhbhrg](https://discuss.elastic.co/u/utkhbhrg)\ **Replies:** 2\ **Last updated:** [August 18, 2020, 9:05pm UTC](https://discuss.elastic.co/t/kibana-oss-7-8-0-logo-change/245306 "2020-08-18T21:05:34Z")
Hello Community, I want to change the logo of Kibana 7.8.0 - OSS. Can anyone guide me how to do that ? --- ## [What is going to happen for query/indexing requests sent to master node](https://discuss.elastic.co/t/what-is-going-to-happen-for-query-indexing-requests-sent-to-master-node/245475)
**Author:** [@junhuangli](https://discuss.elastic.co/u/junhuangli)\ **Replies:** 2\ **Last updated:** [August 18, 2020, 9:02pm UTC](https://discuss.elastic.co/t/what-is-going-to-happen-for-query-indexing-requests-sent-to-master-node/245475 "2020-08-18T21:02:19Z")
We have an elastic-search cluster with 3 data nodes and 3 master nodes. When using it, all traffic(query+indexing) are sent to master nodes in round robin right now. After reading docs, I believe we should change it to … --- ## [Is it safe to rename node in ES 6.8?](https://discuss.elastic.co/t/is-it-safe-to-rename-node-in-es-6-8/245482)
**Author:** [@tarkhil](https://discuss.elastic.co/u/tarkhil)\ **Replies:** 1\ **Last updated:** [August 18, 2020, 8:56pm UTC](https://discuss.elastic.co/t/is-it-safe-to-rename-node-in-es-6-8/245482 "2020-08-18T20:56:35Z")
Hello I've googled on the topic but everything I've found is dated 2015; many things could change since that time. So I'm reasking, is it safe to rename node in 6.8? If the node was already in use, should I do somethin… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1856) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1858)