# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=269 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 270 --- ## [Files and inode recreated](https://discuss.elastic.co/t/files-and-inode-recreated/356793)
**Author:** [@dequedepende](https://discuss.elastic.co/u/dequedepende)\ **Replies:** 3\ **Last updated:** [April 5, 2024, 12:24pm UTC](https://discuss.elastic.co/t/files-and-inode-recreated/356793 "2024-04-05T12:24:25Z")
Hello all, We have an strange case, where files are deleted and created again, so the inodes changes: File: ‘/logs-prod/log.log’ Size: 33235073 Blocks: 64920 IO Block: 1048576 regular file Device: 2ah/4… --- ## [\_search request peformance with explain option turned on](https://discuss.elastic.co/t/search-request-peformance-with-explain-option-turned-on/356717)
**Author:** [@yana2301](https://discuss.elastic.co/u/yana2301)\ **Replies:** 1\ **Last updated:** [April 5, 2024, 12:22pm UTC](https://discuss.elastic.co/t/search-request-peformance-with-explain-option-turned-on/356717 "2024-04-05T12:22:21Z")
Hello! I've got a question on explain query param: I'd like to keep track of score calculation history for each request. To do this I plan to set explain=true for each search request and log explain section from respons… --- ## [Fingerprint plugin not working properly](https://discuss.elastic.co/t/fingerprint-plugin-not-working-properly/356845)
**Author:** [@Amer\_Uljic](https://discuss.elastic.co/u/Amer_Uljic)\ **Replies:** 5\ **Last updated:** [April 5, 2024, 11:59am UTC](https://discuss.elastic.co/t/fingerprint-plugin-not-working-properly/356845 "2024-04-05T11:59:18Z")
I have logs that I receive daily in a JSON form and most of them contain unique identifiers such as ip addresses and ports. A lot of them repeat daily so I want to filter them out but their timestamp changes and elastic … --- ## [Airgapped install of plugin fails trying to access artifacts.elastic.co](https://discuss.elastic.co/t/airgapped-install-of-plugin-fails-trying-to-access-artifacts-elastic-co/356781)
**Author:** [@SebastianThorn](https://discuss.elastic.co/u/SebastianThorn)\ **Replies:** 5\ **Last updated:** [April 5, 2024, 10:25am UTC](https://discuss.elastic.co/t/airgapped-install-of-plugin-fails-trying-to-access-artifacts-elastic-co/356781 "2024-04-05T10:25:56Z")
Hello, I'm trying to install a plugin behind an airgapped environment. The environment has access to a private RubyGems-repository located in Artifactory. I'm getting this error: \> \[config 4/5\] RUN logstash-plugin i… --- ## [Agent in fleet, how to change settings?](https://discuss.elastic.co/t/agent-in-fleet-how-to-change-settings/356857)
**Author:** [@jfrank](https://discuss.elastic.co/u/jfrank)\ **Replies:** 0\ **Last updated:** [April 5, 2024, 10:07am UTC](https://discuss.elastic.co/t/agent-in-fleet-how-to-change-settings/356857 "2024-04-05T10:07:51Z")
my elastic-agent is enrolled to fleet. Where can I change settings regarding json files from "/var/log/elastic-agent"? I want to stop writing it. --- ## [Sharepoint Connector issue - configuring api permissions](https://discuss.elastic.co/t/sharepoint-connector-issue-configuring-api-permissions/356831)
**Author:** [@Akshayd302](https://discuss.elastic.co/u/Akshayd302)\ **Replies:** 1\ **Last updated:** [April 5, 2024, 9:15am UTC](https://discuss.elastic.co/t/sharepoint-connector-issue-configuring-api-permissions/356831 "2024-04-05T09:15:00Z")
We are using elastic' sharepoint native connector but running into an issue where from organization policy perspective are only allowed to get permission to access only limited sites and not all. Elastic sharepoint conn… --- ## [How to Secure dashboard iframe of (public url)](https://discuss.elastic.co/t/how-to-secure-dashboard-iframe-of-public-url/356835)
**Author:** [@kishorkumar](https://discuss.elastic.co/u/kishorkumar)\ **Replies:** 3\ **Last updated:** [April 5, 2024, 8:37am UTC](https://discuss.elastic.co/t/how-to-secure-dashboard-iframe-of-public-url/356835 "2024-04-05T08:37:46Z")
Hello @elastic #stack-kibana #dev-kibana. We aim to create a restricted dashboard's iframe of public url. It is accessible only if the dashboard contains the userIds. if user access the dashbaord's public url without t… --- ## [Log tuning](https://discuss.elastic.co/t/log-tuning/356844)
**Author:** [@Ganesh\_DV](https://discuss.elastic.co/u/Ganesh_DV)\ **Replies:** 0\ **Last updated:** [April 5, 2024, 8:00am UTC](https://discuss.elastic.co/t/log-tuning/356844 "2024-04-05T08:00:38Z")
Hi team, Im ingesting logs from Active directory (AD) server to elastic SIEM but daily im getting 2cr logs from 1 single server. such servers we have 4. so kindly help me , how to reduce such huge log source without co… --- ## [Index LifeCycle Management](https://discuss.elastic.co/t/index-lifecycle-management/356759)
**Author:** [@spazzrabbit](https://discuss.elastic.co/u/spazzrabbit)\ **Replies:** 6\ **Last updated:** [April 5, 2024, 6:45am UTC](https://discuss.elastic.co/t/index-lifecycle-management/356759 "2024-04-05T06:45:56Z")
Hello everyone, I'm having issues with lifecycle policy. Currently I'm receiving log from one windows server, logstash outputs it to elastic succesfully. When lifecycle begins it creates new index but keeps writing to … --- ## [Store last X documents per id](https://discuss.elastic.co/t/store-last-x-documents-per-id/356737)
**Author:** [@vsadokhin](https://discuss.elastic.co/u/vsadokhin)\ **Replies:** 10\ **Last updated:** [April 5, 2024, 5:24am UTC](https://discuss.elastic.co/t/store-last-x-documents-per-id/356737 "2024-04-05T05:24:48Z")
Hello Elastic's team and community! I am looking for a way to keep only recent documents for a particular id. Ideally it happens automatically via some Elasticsearch configuration or with one hop request after a new doc… --- ## [Integrations | could i install multi elastic agent on a host?](https://discuss.elastic.co/t/integrations-could-i-install-multi-elastic-agent-on-a-host/356834)
**Author:** [@Trung\_Le\_Thanh](https://discuss.elastic.co/u/Trung_Le_Thanh)\ **Replies:** 0\ **Last updated:** [April 5, 2024, 4:16am UTC](https://discuss.elastic.co/t/integrations-could-i-install-multi-elastic-agent-on-a-host/356834 "2024-04-05T04:16:51Z")
My windows machine run iis service, i want to collect iis logs with "IIS" integration and window logs with "Windows" integrations, i have installed and configured elastic-egent for "Windows" on my host, which was sendin… --- ## [What happens during Elasticsearch refresh?](https://discuss.elastic.co/t/what-happens-during-elasticsearch-refresh/356780)
**Author:** [@EVINDX](https://discuss.elastic.co/u/EVINDX)\ **Replies:** 2\ **Last updated:** [April 5, 2024, 4:04am UTC](https://discuss.elastic.co/t/what-happens-during-elasticsearch-refresh/356780 "2024-04-05T04:04:55Z")
Hello, I'm trying to understand the flow of data inside the Elasticsearch and based on what I could gather so far, New data is first appended to the tranlsog and an in-memory buffer. Optionally doing a refresh (explic… --- ## [Set "number\_of\_replicas" to 0 permanently](https://discuss.elastic.co/t/set-number-of-replicas-to-0-permanently/356754)
**Author:** [@DaddyYusk](https://discuss.elastic.co/u/DaddyYusk)\ **Replies:** 6\ **Last updated:** [April 4, 2024, 11:24pm UTC](https://discuss.elastic.co/t/set-number-of-replicas-to-0-permanently/356754 "2024-04-04T23:24:40Z")
Hi, Because of my current Elasticsearch cluster deployment (only one Hot node, not best practice, I know), I need to set the "number\_of\_replicas" of all my already an newly created indexes to 0. As I use a Fleet Server… --- ## [Attempted to resurrect connection to dead ES instance](https://discuss.elastic.co/t/attempted-to-resurrect-connection-to-dead-es-instance/356816)
**Author:** [@yjavvaji](https://discuss.elastic.co/u/yjavvaji)\ **Replies:** 2\ **Last updated:** [April 4, 2024, 9:52pm UTC](https://discuss.elastic.co/t/attempted-to-resurrect-connection-to-dead-es-instance/356816 "2024-04-04T21:52:32Z")
Hi, I am trying to setup logstash pipeline from kafka to Elasticsearch. The logstash logs show Attempted to resurrect connection to dead ES instance error. \[logstash.outputs.elasticsearch\]\[main\] Attempted to resurrect … --- ## [Can Logstash convert a string into a version field type?](https://discuss.elastic.co/t/can-logstash-convert-a-string-into-a-version-field-type/356810)
**Author:** [@Michael\_Cook](https://discuss.elastic.co/u/Michael_Cook)\ **Replies:** 2\ **Last updated:** [April 4, 2024, 7:15pm UTC](https://discuss.elastic.co/t/can-logstash-convert-a-string-into-a-version-field-type/356810 "2024-04-04T19:15:56Z")
I've come across Version field type | Elasticsearch Guide \[8.12\] | Elastic which describes exactly what I want to do with a semver text field I'm ingesting via Logstash. However, is it possible in the Logstash filter pi… --- ## [Disable alarming for "remote\_cluster\_client"](https://discuss.elastic.co/t/disable-alarming-for-remote-cluster-client/356634)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 1\ **Last updated:** [April 4, 2024, 6:01pm UTC](https://discuss.elastic.co/t/disable-alarming-for-remote-cluster-client/356634 "2024-04-04T18:01:08Z")
Hi I saw already the similar case on that forum but do we have any change to disable alerting only for CCR ? Executing Alert default:monitoring\_shard\_size:9c04b600-2f8e-11ee-a4d8-cdf0d74e has resulted in Error: illegal… --- ## [Delete index policy for every X minutes](https://discuss.elastic.co/t/delete-index-policy-for-every-x-minutes/356805)
**Author:** [@mpniel](https://discuss.elastic.co/u/mpniel)\ **Replies:** 3\ **Last updated:** [April 4, 2024, 5:39pm UTC](https://discuss.elastic.co/t/delete-index-policy-for-every-x-minutes/356805 "2024-04-04T17:39:08Z")
What is the Kibana Api command to create a delete index policy for every X minutes to a group of indexes with name starting string indA ? --- ## [Index template put versus post](https://discuss.elastic.co/t/index-template-put-versus-post/356806)
**Author:** [@mpniel](https://discuss.elastic.co/u/mpniel)\ **Replies:** 1\ **Last updated:** [April 4, 2024, 5:24pm UTC](https://discuss.elastic.co/t/index-template-put-versus-post/356806 "2024-04-04T17:24:24Z")
What is the correct Kibana Api command to create an index template ? --- ## [Logstash UDP input ingest big payloads](https://discuss.elastic.co/t/logstash-udp-input-ingest-big-payloads/356790)
**Author:** [@vivere-dally](https://discuss.elastic.co/u/vivere-dally)\ **Replies:** 1\ **Last updated:** [April 4, 2024, 5:09pm UTC](https://discuss.elastic.co/t/logstash-udp-input-ingest-big-payloads/356790 "2024-04-04T17:09:12Z")
Hi. I have a simple Logstash pipeline: input { udp { port =\> 50001 codec =\> "json" } } output { elasticsearch { // elastic data } } I observed that when I submit a bigger payload it does not get ingested. Is… --- ## [API Connect offloading to ElasticSearch Error](https://discuss.elastic.co/t/api-connect-offloading-to-elasticsearch-error/356719)
**Author:** [@m2web1](https://discuss.elastic.co/u/m2web1)\ **Replies:** 3\ **Last updated:** [April 4, 2024, 4:21pm UTC](https://discuss.elastic.co/t/api-connect-offloading-to-elasticsearch-error/356719 "2024-04-04T16:21:11Z")
When attempting to offload to our ElasticSerach instance, we are seeing the following error: \[2024-04-03T20:00:32,154\]\[INFO \]\[logstash.outputs.elasticsearch\] Failed to perform request {:message=\>"PKIX path building fail… --- ## [Auditbeat log to syslog without information](https://discuss.elastic.co/t/auditbeat-log-to-syslog-without-information/356748)
**Author:** [@Roberto3](https://discuss.elastic.co/u/Roberto3)\ **Replies:** 1\ **Last updated:** [April 4, 2024, 4:20pm UTC](https://discuss.elastic.co/t/auditbeat-log-to-syslog-without-information/356748 "2024-04-04T16:20:21Z")
Hi, I have a problem to send the audibeat log to my syslog. If I send the log to the file inside the file I can show some useful information such as the modified file etc, but If I send the same information to the sysl… --- ## [Is index rolling possible with parent-child modeling?](https://discuss.elastic.co/t/is-index-rolling-possible-with-parent-child-modeling/356794)
**Author:** [@getsolaris](https://discuss.elastic.co/u/getsolaris)\ **Replies:** 2\ **Last updated:** [April 4, 2024, 3:22pm UTC](https://discuss.elastic.co/t/is-index-rolling-possible-with-parent-child-modeling/356794 "2024-04-04T15:22:35Z")
Hello, I am working on parent-child modeling. We are testing whether time series-based index rolling is possible. Scenario Members are stored in index 202404 (assuming they joined in Apr 2024) Membership access inform… --- ## [Drop\_event filter](https://discuss.elastic.co/t/drop-event-filter/356638)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 6\ **Last updated:** [April 4, 2024, 3:22pm UTC](https://discuss.elastic.co/t/drop-event-filter/356638 "2024-04-04T15:22:16Z")
I have following filter in system.yml file and working fine dropping event if username is root or ntp or process has myjob.\* pattern. processors: - drop\_event: when: or: - equals:… --- ## [Logstash truncate messages with more than 30 kb](https://discuss.elastic.co/t/logstash-truncate-messages-with-more-than-30-kb/356755)
**Author:** [@Pedro\_Lopez\_Gonzalez](https://discuss.elastic.co/u/Pedro_Lopez_Gonzalez)\ **Replies:** 2\ **Last updated:** [April 4, 2024, 3:16pm UTC](https://discuss.elastic.co/t/logstash-truncate-messages-with-more-than-30-kb/356755 "2024-04-04T15:16:00Z")
Hi all Im sending messages from filebeat to logstash, but the messages are more longers than 30 kb. Logstash is truncating the messages and I can't process complete. It's possible to increase this limit? beats { po… --- ## [Cannot install logstash plugin](https://discuss.elastic.co/t/cannot-install-logstash-plugin/356665)
**Author:** [@DOkuwa](https://discuss.elastic.co/u/DOkuwa)\ **Replies:** 2\ **Last updated:** [April 4, 2024, 1:51pm UTC](https://discuss.elastic.co/t/cannot-install-logstash-plugin/356665 "2024-04-04T13:51:54Z")
cannot install logstash plugin on redhat linux 8 get error message ./logstash-plugin install --version 0.1.0-beta5 lostash-input-snmp Using bundled JDK: /usr/share/logstash/jdk ERROR: Something went wrong when instal… --- ## [High availability of ELK server](https://discuss.elastic.co/t/high-availability-of-elk-server/356783)
**Author:** [@kaushalshriyan](https://discuss.elastic.co/u/kaushalshriyan)\ **Replies:** 1\ **Last updated:** [April 4, 2024, 1:49pm UTC](https://discuss.elastic.co/t/high-availability-of-elk-server/356783 "2024-04-04T13:49:10Z")
Hi, I am running a single instance of ELK server on RHEL8.9 which is not reliable as of now if the VM instance goes down which will result in Single point of failure scenario. I have planned to setup second ELK node2 … --- ## [Is it possible to get the size of a closed index without opening it?](https://discuss.elastic.co/t/is-it-possible-to-get-the-size-of-a-closed-index-without-opening-it/356716)
**Author:** [@pingo](https://discuss.elastic.co/u/pingo)\ **Replies:** 2\ **Last updated:** [April 4, 2024, 1:20pm UTC](https://discuss.elastic.co/t/is-it-possible-to-get-the-size-of-a-closed-index-without-opening-it/356716 "2024-04-04T13:20:50Z")
The \_cat/indices API only shows the store size of open indices. Is there anyway to get the store size of closed indices? --- ## [Logstash stopped processing because of error\[system exit\]](https://discuss.elastic.co/t/logstash-stopped-processing-because-of-error-system-exit/356773)
**Author:** [@2328943\_dc](https://discuss.elastic.co/u/2328943_dc)\ **Replies:** 1\ **Last updated:** [April 4, 2024, 1:07pm UTC](https://discuss.elastic.co/t/logstash-stopped-processing-because-of-error-system-exit/356773 "2024-04-04T13:07:51Z")
We have newly installed kibana on server but when we checked logstash logs getting fatal error as highlighted below. --- ## [Metrics with Formula Doesn't appear in "RANK BY" option in LENS](https://discuss.elastic.co/t/metrics-with-formula-doesnt-appear-in-rank-by-option-in-lens/356644)
**Author:** [@Arshukla](https://discuss.elastic.co/u/Arshukla)\ **Replies:** 1\ **Last updated:** [April 4, 2024, 12:58pm UTC](https://discuss.elastic.co/t/metrics-with-formula-doesnt-appear-in-rank-by-option-in-lens/356644 "2024-04-04T12:58:18Z")
Hello Team, I'm currently working on setting up a tabular dashboard in LENS. I'm in the process of defining variables within the "Metrics" option. However, when I choose the TOP Value for the Rows field, I notice that o… --- ## [Ingest Custom date Format data to Elastic Index](https://discuss.elastic.co/t/ingest-custom-date-format-data-to-elastic-index/356736)
**Author:** [@Debasis\_Mallick](https://discuss.elastic.co/u/Debasis_Mallick)\ **Replies:** 3\ **Last updated:** [April 4, 2024, 12:26pm UTC](https://discuss.elastic.co/t/ingest-custom-date-format-data-to-elastic-index/356736 "2024-04-04T12:26:48Z")
Hi Team, We are trying to ingest a custom date format data to Elastic Index where the field mapping is as below. "edate":{ "type":"date", "format":\["yyyy-mm-dd"\] } We are using filebeat to ingest… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=268) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=270)