# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=671 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 672 --- ## [Filebeat is unable to create custom index](https://discuss.elastic.co/t/filebeat-is-unable-to-create-custom-index/322755)
**Author:** [@AdityaKhajuria](https://discuss.elastic.co/u/AdityaKhajuria)\ **Replies:** 11\ **Last updated:** [January 11, 2023, 11:19am UTC](https://discuss.elastic.co/t/filebeat-is-unable-to-create-custom-index/322755 "2023-01-11T11:19:55Z")
Hi team, Im trying to create custom index with Filebeat and ive read the official docs and disabled the ilm (setup.ilm.enabled: false) and also configured the template name and pattern but now index template is getting … --- ## [Cat Nodes API returning CPU usage as -1. Elasticsearch version:7.11.2 OS Deb 11](https://discuss.elastic.co/t/cat-nodes-api-returning-cpu-usage-as-1-elasticsearch-version-7-11-2-os-deb-11/322912)
**Author:** [@Sagar\_Shivani1](https://discuss.elastic.co/u/Sagar_Shivani1)\ **Replies:** 1\ **Last updated:** [January 11, 2023, 10:59am UTC](https://discuss.elastic.co/t/cat-nodes-api-returning-cpu-usage-as-1-elasticsearch-version-7-11-2-os-deb-11/322912 "2023-01-11T10:59:42Z")
Cat Nodes API returning CPU usage as -1. Elasticsearch version:7.11.2 OS Deb 11.. What can be the case? --- ## [How to create an array runtime field](https://discuss.elastic.co/t/how-to-create-an-array-runtime-field/322791)
**Author:** [@cr\_168328](https://discuss.elastic.co/u/cr_168328)\ **Replies:** 15\ **Last updated:** [January 11, 2023, 10:53am UTC](https://discuss.elastic.co/t/how-to-create-an-array-runtime-field/322791 "2023-01-11T10:53:23Z")
I have an index with a nested field 'roles': "roles": { "type": "nested", "properties": { "name": { "type": "text", "fields": { "raw": { "type"… --- ## [Is it okay to keep too frequent rollups?](https://discuss.elastic.co/t/is-it-okay-to-keep-too-frequent-rollups/322909)
**Author:** [@mafia-task-pasta](https://discuss.elastic.co/u/mafia-task-pasta)\ **Replies:** 0\ **Last updated:** [January 11, 2023, 10:48am UTC](https://discuss.elastic.co/t/is-it-okay-to-keep-too-frequent-rollups/322909 "2023-01-11T10:48:21Z")
I have a lots of data in elasticsearch for which I am adding a new rollups. It is taking a lot of time to catch up on all historical data. I am running it at 1 hour interval using the cron expression and the page size if… --- ## [Running logstash with user nobody:nogroup is broken in logstash:7.17.8 - Easily reproducible](https://discuss.elastic.co/t/running-logstash-with-user-nobody-nogroup-is-broken-in-logstash-7-17-8-easily-reproducible/322874)
**Author:** [@mikeba](https://discuss.elastic.co/u/mikeba)\ **Replies:** 1\ **Last updated:** [January 11, 2023, 10:42am UTC](https://discuss.elastic.co/t/running-logstash-with-user-nobody-nogroup-is-broken-in-logstash-7-17-8-easily-reproducible/322874 "2023-01-11T10:42:49Z")
Our usage of logstash requires that we run as user nobody:nogroup and we run with an appropriate securityContext in K8s that enforces it + denies PriviledgeEscalation to root securityContext: allowPrivilegeEsc… --- ## [Saved Discover Visual Download csv option doesn't provide the result data](https://discuss.elastic.co/t/saved-discover-visual-download-csv-option-doesnt-provide-the-result-data/320555)
**Author:** [@Susendiran](https://discuss.elastic.co/u/Susendiran)\ **Replies:** 6\ **Last updated:** [December 14, 2022, 11:38am UTC](https://discuss.elastic.co/t/saved-discover-visual-download-csv-option-doesnt-provide-the-result-data/320555 "2022-12-14T11:38:34Z")
Hi All, I've done an discover visual which has nearly 6k data. I added that visual to a dashboard and tried to download the data as csv. When I clicked on the download csv button which is available in the saved discover… --- ## [SNMP Traps version 3](https://discuss.elastic.co/t/snmp-traps-version-3/322889)
**Author:** [@m3bgwad](https://discuss.elastic.co/u/m3bgwad)\ **Replies:** 4\ **Last updated:** [January 11, 2023, 10:06am UTC](https://discuss.elastic.co/t/snmp-traps-version-3/322889 "2023-01-11T10:06:39Z")
Hello Everyone, Can the snmptrap input plugin for logstash receive snmp version 3 traps ? If not, are there other solutions ? I would like to collect SNMP v3 traps. Thank You --- ## [Facing issues with ILM on auto indexes](https://discuss.elastic.co/t/facing-issues-with-ilm-on-auto-indexes/322789)
**Author:** [@rahul\_sirugudi](https://discuss.elastic.co/u/rahul_sirugudi)\ **Replies:** 2\ **Last updated:** [January 11, 2023, 8:58am UTC](https://discuss.elastic.co/t/facing-issues-with-ilm-on-auto-indexes/322789 "2023-01-11T08:58:50Z")
I am playing with ILM on one index named as filebeat-7.17.8-2023.01.09. This is the auto index. i want to create ILM on this so i have created alias for this index. curl -XPUT 'ip/filebeat-7.17.8-\*/\_alias/filebeat-000… --- ## [How to calculate disk space if 1tb of data ingested every day and log reteyis 180 days](https://discuss.elastic.co/t/how-to-calculate-disk-space-if-1tb-of-data-ingested-every-day-and-log-reteyis-180-days/322893)
**Author:** [@happylearning](https://discuss.elastic.co/u/happylearning)\ **Replies:** 1\ **Last updated:** [January 11, 2023, 9:06am UTC](https://discuss.elastic.co/t/how-to-calculate-disk-space-if-1tb-of-data-ingested-every-day-and-log-reteyis-180-days/322893 "2023-01-11T09:06:15Z")
How to calculate disk space if 1tb of data ingested every day and log reteyis 180 days --- ## [Combining phonetic filter with synonym\_graph filter](https://discuss.elastic.co/t/combining-phonetic-filter-with-synonym-graph-filter/322838)
**Author:** [@rune](https://discuss.elastic.co/u/rune)\ **Replies:** 0\ **Last updated:** [January 10, 2023, 1:12pm UTC](https://discuss.elastic.co/t/combining-phonetic-filter-with-synonym-graph-filter/322838 "2023-01-10T13:12:25Z")
So - I want to use the phonetic filter to transform the user query into phonetic hashes as it's supposed to do. F.ex. with "refined\_soundex" i get: pacemaker -\> P103080309 Then I want to take this hash value to my syno… --- ## [Use observability service map in plugin](https://discuss.elastic.co/t/use-observability-service-map-in-plugin/322876)
**Author:** [@Sheereen](https://discuss.elastic.co/u/Sheereen)\ **Replies:** 1\ **Last updated:** [January 11, 2023, 9:01am UTC](https://discuss.elastic.co/t/use-observability-service-map-in-plugin/322876 "2023-01-11T09:01:31Z")
Hi, I am developing a custom external plugin for Kibana. I want to have a functionality similar to the service maps in Observability \> APM \> Service Map in my plugin. Is there a way to import it from Kibana core and us… --- ## [Kbn\_network plugin for Kibana 8.5+?](https://discuss.elastic.co/t/kbn-network-plugin-for-kibana-8-5/322891)
**Author:** [@Sheereen](https://discuss.elastic.co/u/Sheereen)\ **Replies:** 1\ **Last updated:** [January 11, 2023, 8:24am UTC](https://discuss.elastic.co/t/kbn-network-plugin-for-kibana-8-5/322891 "2023-01-11T08:24:47Z")
Hi, Is the kbn\_network plugin available for Kibana version 8.5+? Thanks --- ## [Different Doc count after reindexing](https://discuss.elastic.co/t/different-doc-count-after-reindexing/322826)
**Author:** [@cr\_168328](https://discuss.elastic.co/u/cr_168328)\ **Replies:** 5\ **Last updated:** [January 11, 2023, 8:10am UTC](https://discuss.elastic.co/t/different-doc-count-after-reindexing/322826 "2023-01-11T08:10:11Z")
I have an index user1. To add some fields, I created a new index and did reindexing using the query: POST /\_reindex?scroll=30m { "source": { "index": "user1" }, "dest": { "index": "user2" } } After rei… --- ## [Need Some Help Understanding Match Query Behavior](https://discuss.elastic.co/t/need-some-help-understanding-match-query-behavior/322870)
**Author:** [@denvaar](https://discuss.elastic.co/u/denvaar)\ **Replies:** 2\ **Last updated:** [January 11, 2023, 7:10am UTC](https://discuss.elastic.co/t/need-some-help-understanding-match-query-behavior/322870 "2023-01-11T07:10:43Z")
I'm confused why the match query seen below is matching two documents rather than just one. I thought using the "and" operator would require all terms to be present in order for it to match. When I hit the explain endpo… --- ## [Exclude log messages in logstash](https://discuss.elastic.co/t/exclude-log-messages-in-logstash/322829)
**Author:** [@tejal\_kubde](https://discuss.elastic.co/u/tejal_kubde)\ **Replies:** 7\ **Last updated:** [January 11, 2023, 6:31am UTC](https://discuss.elastic.co/t/exclude-log-messages-in-logstash/322829 "2023-01-11T06:31:50Z")
I'm picking up data from log files using filebeat and sending it to Elasticsearch via Logstash. I wanted to exclude few log lines. So can I use an if condition in Logstash. If yes, please share me the format and guide me… --- ## [Logstash configuration to delete input files once processed](https://discuss.elastic.co/t/logstash-configuration-to-delete-input-files-once-processed/322029)
**Author:** [@BhawanaSharma](https://discuss.elastic.co/u/BhawanaSharma)\ **Replies:** 11\ **Last updated:** [January 11, 2023, 6:27am UTC](https://discuss.elastic.co/t/logstash-configuration-to-delete-input-files-once-processed/322029 "2023-01-11T06:27:43Z")
I am trying to delete input files from directory once it was processed by Filebeat. Also wanted to confirm from filebeat that particular file is already processed so it is safe to delete. For that I tried few things on m… --- ## [Bucket split group terms data coming in missing through filebeat](https://discuss.elastic.co/t/bucket-split-group-terms-data-coming-in-missing-through-filebeat/322869)
**Author:** [@devdev7711](https://discuss.elastic.co/u/devdev7711)\ **Replies:** 0\ **Last updated:** [January 11, 2023, 6:12am UTC](https://discuss.elastic.co/t/bucket-split-group-terms-data-coming-in-missing-through-filebeat/322869 "2023-01-11T06:12:56Z")
We are using filebeat to read logs we have 2 logs entry count but when we are doing metrics bucket split group aggregation that time these 2 records are not visible those are coming in missing. below is the log det… --- ## [Search is not working properly on cluster 2 node setup](https://discuss.elastic.co/t/search-is-not-working-properly-on-cluster-2-node-setup/322851)
**Author:** [@arjunmalu](https://discuss.elastic.co/u/arjunmalu)\ **Replies:** 2\ **Last updated:** [January 11, 2023, 5:39am UTC](https://discuss.elastic.co/t/search-is-not-working-properly-on-cluster-2-node-setup/322851 "2023-01-11T05:39:36Z")
Hi Elastic team, I am using Elasticsearch service on 2 node setup. Both the nodes have default configuration (elasticsearch.yml). Case : Suppose there are 50 entries in a list to search from. A new entry ("newentry51")… --- ## [Kibana 8.x Controls search don't find items](https://discuss.elastic.co/t/kibana-8-x-controls-search-dont-find-items/318667)
**Author:** [@ntkclara](https://discuss.elastic.co/u/ntkclara)\ **Replies:** 3\ **Last updated:** [November 16, 2022, 11:22am UTC](https://discuss.elastic.co/t/kibana-8-x-controls-search-dont-find-items/318667 "2022-11-16T11:22:33Z")
I was using ELK stack 7.x but i had issues with input controls. (For example case sensitivity or Data might be incomplete pop up) I saw that in ELK Stack 8.x, problems was solved. So I upgrade my stack to 8.5 But now,… --- ## [Regex on filtered data on Kibana](https://discuss.elastic.co/t/regex-on-filtered-data-on-kibana/318916)
**Author:** [@Anil\_Alapati](https://discuss.elastic.co/u/Anil_Alapati)\ **Replies:** 6\ **Last updated:** [December 14, 2022, 6:13am UTC](https://discuss.elastic.co/t/regex-on-filtered-data-on-kibana/318916 "2022-12-14T06:13:44Z")
Hi, is there any feature that can add regex and show the data on visualization? Like Name is 123@bc.com. it should show only 123 --- ## [Rule execution failure: Rule registry writing is disabled](https://discuss.elastic.co/t/rule-execution-failure-rule-registry-writing-is-disabled/314755)
**Author:** [@alytkowski](https://discuss.elastic.co/u/alytkowski)\ **Replies:** 4\ **Last updated:** [January 10, 2023, 10:56pm UTC](https://discuss.elastic.co/t/rule-execution-failure-rule-registry-writing-is-disabled/314755 "2023-01-10T22:56:08Z")
I've created a rule for logs threshold, and there is an error while running the rule: 'Process check wildfly' (that's the name of the rule) - Rule registry writing is disabled due to an error during Rule Data Client Ini… --- ## [Keycloak authorization not working in Kibana](https://discuss.elastic.co/t/keycloak-authorization-not-working-in-kibana/318940)
**Author:** [@Sheereen](https://discuss.elastic.co/u/Sheereen)\ **Replies:** 1\ **Last updated:** [November 15, 2022, 11:45pm UTC](https://discuss.elastic.co/t/keycloak-authorization-not-working-in-kibana/318940 "2022-11-15T23:45:48Z")
Hi, As was in the documentation, I created resources, policies and permissions. In the evaluate tab, I can get PERMIT and DENY, correctly as per logic for users with specific roles. But the same doesn’t work when in K… --- ## [EuiCombobox is not working properly](https://discuss.elastic.co/t/euicombobox-is-not-working-properly/322544)
**Author:** [@Frlopezc](https://discuss.elastic.co/u/Frlopezc)\ **Replies:** 3\ **Last updated:** [January 10, 2023, 6:03pm UTC](https://discuss.elastic.co/t/euicombobox-is-not-working-properly/322544 "2023-01-10T18:03:33Z")
Hi everyone. Im using elastic and i'm trying to use the component Combobox but they options appear further from the element that it should be. (Shown in the following image) the combobox used is: \ **Author:** [@cdy5159](https://discuss.elastic.co/u/cdy5159)\ **Replies:** 9\ **Last updated:** [January 10, 2023, 4:36pm UTC](https://discuss.elastic.co/t/three-node-cluster-failes-completely-when-one-node-shuts-down/322638 "2023-01-10T16:36:01Z") I have a three node cluster with Elastic 8.4.2. When all three nodes are up, it all appears fine. I built the cluster with a single node (audit1), but later added the other two nodes (audit2 & audit3). If I shutdown e… --- ## [Gsub with regex](https://discuss.elastic.co/t/gsub-with-regex/322756)
**Author:** [@searchtastic](https://discuss.elastic.co/u/searchtastic)\ **Replies:** 1\ **Last updated:** [January 10, 2023, 4:32pm UTC](https://discuss.elastic.co/t/gsub-with-regex/322756 "2023-01-10T16:32:26Z")
Hi, My regex is matching my condition on my ingest pipeline, however I am struggling to wrap my found string with quotes for the replacement. expression. "gsub": { "field": "message", "pattern": "\\b\[0-… --- ## [Filebeat Warnings in Office 365 Logs](https://discuss.elastic.co/t/filebeat-warnings-in-office-365-logs/322841)
**Author:** [@Rohit\_Kumbhar](https://discuss.elastic.co/u/Rohit_Kumbhar)\ **Replies:** 1\ **Last updated:** [January 10, 2023, 3:40pm UTC](https://discuss.elastic.co/t/filebeat-warnings-in-office-365-logs/322841 "2023-01-10T15:40:37Z")
Hi Elastic Team, I am running Multiple O365 Tenants in filebeat but some of the tenants giving following warning Got error 500 The input stream is not a valid binary format. The starting contents (in bytes) are: 22-68… --- ## [Searching special characters !, $, #, @](https://discuss.elastic.co/t/searching-special-characters/322727)
**Author:** [@oktaykalfa](https://discuss.elastic.co/u/oktaykalfa)\ **Replies:** 2\ **Last updated:** [January 10, 2023, 1:43pm UTC](https://discuss.elastic.co/t/searching-special-characters/322727 "2023-01-10T13:43:37Z")
Hello, My config is be like in the following and i want to search special characters like !, $, @, # too. class ConversationIndexConfigurator extends IndexConfigurator { use Migratable; protected $name = 'conv… --- ## [How does logstash use pipeline.batch.size to execute pipeline?](https://discuss.elastic.co/t/how-does-logstash-use-pipeline-batch-size-to-execute-pipeline/322772)
**Author:** [@rickfish](https://discuss.elastic.co/u/rickfish)\ **Replies:** 7\ **Last updated:** [January 10, 2023, 2:00pm UTC](https://discuss.elastic.co/t/how-does-logstash-use-pipeline-batch-size-to-execute-pipeline/322772 "2023-01-10T14:00:03Z")
I am looking for documentation on how Logstash processes a pipeline when pipeline.batch.size is more than 1. This is my assumption: The input plugin generates several events, not dictated by batch size While there are… --- ## [This version of Kibana (v8.5.3) is incompatible with the following Elasticsearch nodes in your cluster: v7.17.8 @ 192.168.240.6:9200 (192.168.240.6)](https://discuss.elastic.co/t/this-version-of-kibana-v8-5-3-is-incompatible-with-the-following-elasticsearch-nodes-in-your-cluster-v7-17-8-192-168-240-6-9200-192-168-240-6/322757)
**Author:** [@bit1290](https://discuss.elastic.co/u/bit1290)\ **Replies:** 1\ **Last updated:** [January 10, 2023, 1:43pm UTC](https://discuss.elastic.co/t/this-version-of-kibana-v8-5-3-is-incompatible-with-the-following-elasticsearch-nodes-in-your-cluster-v7-17-8-192-168-240-6-9200-192-168-240-6/322757 "2023-01-10T13:43:55Z")
I'm having this error: This version of Kibana (v8.5.3) is incompatible with the following Elasticsearch nodes in your cluster: v7.17.8 @ 192.168.240.6:9200 (192.168.240.6) However in my docker ps command output the ver… --- ## [Elasticsearch autocomplete suggestion on array object](https://discuss.elastic.co/t/elasticsearch-autocomplete-suggestion-on-array-object/322375)
**Author:** [@ysunil702](https://discuss.elastic.co/u/ysunil702)\ **Replies:** 14\ **Last updated:** [January 10, 2023, 10:12am UTC](https://discuss.elastic.co/t/elasticsearch-autocomplete-suggestion-on-array-object/322375 "2023-01-10T10:12:52Z")
my mapping as follow : \`"skills": { "properties": { "id": { "type": "long" }, "skillName": { … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=670) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=672)