# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=716 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 717 --- ## [Generating a periodic(i.e. timeslot based, say 2min duration) aggregation on an existing ELK index](https://discuss.elastic.co/t/generating-a-periodic-i-e-timeslot-based-say-2min-duration-aggregation-on-an-existing-elk-index/319858)
**Author:** [@rvadiga](https://discuss.elastic.co/u/rvadiga)\ **Replies:** 1\ **Last updated:** [November 30, 2022, 12:50am UTC](https://discuss.elastic.co/t/generating-a-periodic-i-e-timeslot-based-say-2min-duration-aggregation-on-an-existing-elk-index/319858 "2022-11-30T00:50:59Z")
Hi Team, I need to design or derive a ELK index (configurable time-window/time-slot) populated based on a highly loaded (i.e say 300 million data points generated per day and indexed) ELK index and define a dashboard ba… --- ## [Postman PUT GET](https://discuss.elastic.co/t/postman-put-get/319861)
**Author:** [@codeRed123](https://discuss.elastic.co/u/codeRed123)\ **Replies:** 1\ **Last updated:** [November 30, 2022, 12:50am UTC](https://discuss.elastic.co/t/postman-put-get/319861 "2022-11-30T00:50:20Z")
How to get POSTMAN to create index and all when im doing localhost:9200/ it says "type": "security\_exception", Can some one tell how to resolve this error, when i try it via console of kibana it is fine but I want it in … --- ## [How to change the number of replicas of the indices .internal.preview.alerts-security.alerts-default](https://discuss.elastic.co/t/how-to-change-the-number-of-replicas-of-the-indices-internal-preview-alerts-security-alerts-default/319713)
**Author:** [@Mor123460](https://discuss.elastic.co/u/Mor123460)\ **Replies:** 1\ **Last updated:** [November 30, 2022, 12:49am UTC](https://discuss.elastic.co/t/how-to-change-the-number-of-replicas-of-the-indices-internal-preview-alerts-security-alerts-default/319713 "2022-11-30T00:49:47Z")
Hey :slight\_smile: I have a kibana and elasticsearch installed on the same server, meaning only one data node, without the need for any replicas. I successfully changed all the index templates to: "index.number\_of\_rep… --- ## [How to manage data retention time in ElasticSearch](https://discuss.elastic.co/t/how-to-manage-data-retention-time-in-elasticsearch/319729)
**Author:** [@m3bgwad](https://discuss.elastic.co/u/m3bgwad)\ **Replies:** 1\ **Last updated:** [November 30, 2022, 12:49am UTC](https://discuss.elastic.co/t/how-to-manage-data-retention-time-in-elasticsearch/319729 "2022-11-30T00:49:10Z")
Hello, What is default of index data retention? If I want to change and edit this retentions for customize the time, if the data after I specifically time I want to remove this data. Thanks in advance for your help. --- ## [Kibana alert](https://discuss.elastic.co/t/kibana-alert/319737)
**Author:** [@niyog](https://discuss.elastic.co/u/niyog)\ **Replies:** 0\ **Last updated:** [November 24, 2022, 10:43am UTC](https://discuss.elastic.co/t/kibana-alert/319737 "2022-11-24T10:43:25Z")
Hai, i am new to this kibana and i completed the setup and even the logs are coming. I created an alert with the the rule type "Log threshold" and added the rule as below and saved the rule. The alert is working whe… --- ## [How to put each file name as index name to store Elasticsearch via Filebeat](https://discuss.elastic.co/t/how-to-put-each-file-name-as-index-name-to-store-elasticsearch-via-filebeat/319755)
**Author:** [@Furkan\_Gulseren](https://discuss.elastic.co/u/Furkan_Gulseren)\ **Replies:** 1\ **Last updated:** [November 30, 2022, 12:48am UTC](https://discuss.elastic.co/t/how-to-put-each-file-name-as-index-name-to-store-elasticsearch-via-filebeat/319755 "2022-11-30T00:48:44Z")
Hello, How can I put each filename as index name to store elasticsearch via filebeat? i am using Filebeat to send log files to elasticsearch via logstash conf. i am using wildcard(\*) to get all of the files in director… --- ## [Elasticsearch upgrade](https://discuss.elastic.co/t/elasticsearch-upgrade/319837)
**Author:** [@Suraj\_Jannu](https://discuss.elastic.co/u/Suraj_Jannu)\ **Replies:** 1\ **Last updated:** [November 30, 2022, 12:47am UTC](https://discuss.elastic.co/t/elasticsearch-upgrade/319837 "2022-11-30T00:47:44Z")
Hello, We are planning to upgrade the ELK stack of the below versions to 8.4.3. Elasticsearch: 7.5.1 Kibana : 6.7.2 Logstash : 6.8.12 Questions: What should be the order of Upgrade? (Should I up… --- ## [Data/master node offline for extended period](https://discuss.elastic.co/t/data-master-node-offline-for-extended-period/319566)
**Author:** [@eh2021-elastic](https://discuss.elastic.co/u/eh2021-elastic)\ **Replies:** 1\ **Last updated:** [November 30, 2022, 12:43am UTC](https://discuss.elastic.co/t/data-master-node-offline-for-extended-period/319566 "2022-11-30T00:43:48Z")
I have a 3-node cluster that is used for monitoring. Each node runs the master and data roles. I just noticed that one of the nodes had been offline for a couple of months and after finding out why, the config had been … --- ## [Does elasticsearch8.5.1 support vector dimensionality reduction when using vector retrieval?](https://discuss.elastic.co/t/does-elasticsearch8-5-1-support-vector-dimensionality-reduction-when-using-vector-retrieval/319600)
**Author:** [@xy\_xia](https://discuss.elastic.co/u/xy_xia)\ **Replies:** 0\ **Last updated:** [November 23, 2022, 1:46am UTC](https://discuss.elastic.co/t/does-elasticsearch8-5-1-support-vector-dimensionality-reduction-when-using-vector-retrieval/319600 "2022-11-23T01:46:30Z")
Hello， As far as I know, the number of vector dimensions. Can’t exceed 1024 for indexed vectors ("index": true ), or 2048 for non-indexed vectors. But, my model outputs a vector with dimensions greater than 1024, a… --- ## [Rollover alias vs index alias](https://discuss.elastic.co/t/rollover-alias-vs-index-alias/319698)
**Author:** [@mikhatanu](https://discuss.elastic.co/u/mikhatanu)\ **Replies:** 1\ **Last updated:** [November 30, 2022, 12:42am UTC](https://discuss.elastic.co/t/rollover-alias-vs-index-alias/319698 "2022-11-30T00:42:01Z")
Hello, I am going to apply ILM to an index template from Kibana. When applying to index template, there's a field of "alias for rollover index", but i have set and alias already in index template. What is the difference … --- ## [“distinct” query in elasticsearch java api](https://discuss.elastic.co/t/distinct-query-in-elasticsearch-java-api/319349)
**Author:** [@hmkhitaryan](https://discuss.elastic.co/u/hmkhitaryan)\ **Replies:** 18\ **Last updated:** [November 29, 2022, 11:19pm UTC](https://discuss.elastic.co/t/distinct-query-in-elasticsearch-java-api/319349 "2022-11-29T23:19:05Z")
How to create “distinct” query in elasticsearch java api, like we do in sql. here is my query, which kibana generated, so I should do the same with java, and I'm trying many ways, but again getting with duplicates. "agg… --- ## [How robust is an Elastic cluster for planned single host outages?](https://discuss.elastic.co/t/how-robust-is-an-elastic-cluster-for-planned-single-host-outages/319794)
**Author:** [@ankh](https://discuss.elastic.co/u/ankh)\ **Replies:** 8\ **Last updated:** [November 29, 2022, 9:33pm UTC](https://discuss.elastic.co/t/how-robust-is-an-elastic-cluster-for-planned-single-host-outages/319794 "2022-11-29T21:33:37Z")
We are doing some network changes on about a dozen or so Elastic hosts, necessitating taking each host off the network briefly (up to a few minutes). We have at least 2 replicas for every index (ie 1 primary + 2 replica… --- ## [Normalizing Host Name](https://discuss.elastic.co/t/normalizing-host-name/319124)
**Author:** [@Tim\_Mobley](https://discuss.elastic.co/u/Tim_Mobley)\ **Replies:** 4\ **Last updated:** [November 29, 2022, 9:16pm UTC](https://discuss.elastic.co/t/normalizing-host-name/319124 "2022-11-29T21:16:00Z")
I am getting values for the host.name field in both upper and lower case, which makes searches difficult. What is the simplest way to normalize this field so that it in converted to all caps? --- ## [Kibana Alerts add fields property](https://discuss.elastic.co/t/kibana-alerts-add-fields-property/317999)
**Author:** [@gadelkareem](https://discuss.elastic.co/u/gadelkareem)\ **Replies:** 4\ **Last updated:** [November 2, 2022, 5:24pm UTC](https://discuss.elastic.co/t/kibana-alerts-add-fields-property/317999 "2022-11-02T17:24:41Z")
I am trying to add an extra fields using script\_fields or runtime\_mappings to Kibana alerts. But Kibana replaces the property fields with some timestamp. Is there a solution or workaround? Edit #1 to add code Query /my… --- ## [ELK 7.12.1 version ssl and tsl certificate issue](https://discuss.elastic.co/t/elk-7-12-1-version-ssl-and-tsl-certificate-issue/319411)
**Author:** [@Yog](https://discuss.elastic.co/u/Yog)\ **Replies:** 14\ **Last updated:** [November 29, 2022, 6:47pm UTC](https://discuss.elastic.co/t/elk-7-12-1-version-ssl-and-tsl-certificate-issue/319411 "2022-11-29T18:47:12Z")
I have 3 nodes , in that 1 is master node and 2 are child node , while enable ssl and tsl certificate i am getting an error : below is the error. at java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.j… --- ## [\[Integrations\] F5 Integration, Radware Integration Out Of Date](https://discuss.elastic.co/t/integrations-f5-integration-radware-integration-out-of-date/319241)
**Author:** [@cmendez92](https://discuss.elastic.co/u/cmendez92)\ **Replies:** 2\ **Last updated:** [November 29, 2022, 5:53pm UTC](https://discuss.elastic.co/t/integrations-f5-integration-radware-integration-out-of-date/319241 "2022-11-29T17:53:09Z")
F5 and Radware integrations are deprecated. Let me explain, it is not normal that they have an intermediate parser in JS (without posibility of change fron integration), it is practically better to let the message throug… --- ## [Prevent collision of field types of structured logs](https://discuss.elastic.co/t/prevent-collision-of-field-types-of-structured-logs/319806)
**Author:** [@katexochen](https://discuss.elastic.co/u/katexochen)\ **Replies:** 3\ **Last updated:** [November 29, 2022, 5:01pm UTC](https://discuss.elastic.co/t/prevent-collision-of-field-types-of-structured-logs/319806 "2022-11-29T17:01:09Z")
I'm collecting logs to filebeat, sending them to logstash and from there to elastic. As the logs are structured, I'm using the json filter in logstash to parse the message. Let's say I'm having two messages/logs in json… --- ## [Ignore-above](https://discuss.elastic.co/t/ignore-above/320064)
**Author:** [@Anil\_Alapati](https://discuss.elastic.co/u/Anil_Alapati)\ **Replies:** 1\ **Last updated:** [November 29, 2022, 4:15pm UTC](https://discuss.elastic.co/t/ignore-above/320064 "2022-11-29T16:15:29Z")
Hi, i could see ignore-above variable in index settings. What does this mean and does this applicable to both ELASTIC SEARCH Discovery and Kibana Lens view? --- ## [How to create an alert for windows event log?](https://discuss.elastic.co/t/how-to-create-an-alert-for-windows-event-log/319996)
**Author:** [@jisha](https://discuss.elastic.co/u/jisha)\ **Replies:** 1\ **Last updated:** [November 29, 2022, 4:06pm UTC](https://discuss.elastic.co/t/how-to-create-an-alert-for-windows-event-log/319996 "2022-11-29T16:06:02Z")
Hi , I am completely new to this Alert creation. Need to create alert for winlogbeat with search guard. Does anyone have a template or know where I can find an example watch for an event log? --- ## [I am trying to create a memory usage alert in kibana but its showing 422 statuscode](https://discuss.elastic.co/t/i-am-trying-to-create-a-memory-usage-alert-in-kibana-but-its-showing-422-statuscode/319548)
**Author:** [@jisha](https://discuss.elastic.co/u/jisha)\ **Replies:** 1\ **Last updated:** [November 29, 2022, 4:03pm UTC](https://discuss.elastic.co/t/i-am-trying-to-create-a-memory-usage-alert-in-kibana-but-its-showing-422-statuscode/319548 "2022-11-29T16:03:04Z")
Hi , i am trying to create a memory usage alert in kibana but its showing 422 statuscode, while i define & return application details. This is the source which i used where error is showing up. if i removed applicati… --- ## [Unable to delete datastream using delete datastream api](https://discuss.elastic.co/t/unable-to-delete-datastream-using-delete-datastream-api/320053)
**Author:** [@chinmoy\_padhi](https://discuss.elastic.co/u/chinmoy_padhi)\ **Replies:** 1\ **Last updated:** [November 29, 2022, 3:22pm UTC](https://discuss.elastic.co/t/unable-to-delete-datastream-using-delete-datastream-api/320053 "2022-11-29T15:22:54Z")
Hi I have referred the following link Delete data stream API | Elasticsearch Guide \[7.17\] | Elastic to delete Data stream. Unfortunately, not able to succeed Whenever I tried from console curl -X DELETE localhost:9200/… --- ## [Docker or binaries?](https://discuss.elastic.co/t/docker-or-binaries/320057)
**Author:** [@turboclick](https://discuss.elastic.co/u/turboclick)\ **Replies:** 1\ **Last updated:** [November 29, 2022, 3:10pm UTC](https://discuss.elastic.co/t/docker-or-binaries/320057 "2022-11-29T15:10:19Z")
Hi, I would discover and try ELK. I would install it on ma personal computer. Could you tell me what is the better solution between launch the binaries into a simple folder or use docker and why ? Thanks a lot for y… --- ## [Packetbeat 8.5 high CPU usage after updade from 7.17.7](https://discuss.elastic.co/t/packetbeat-8-5-high-cpu-usage-after-updade-from-7-17-7/320058)
**Author:** [@Alexander\_A](https://discuss.elastic.co/u/Alexander_A)\ **Replies:** 1\ **Last updated:** [November 29, 2022, 2:50pm UTC](https://discuss.elastic.co/t/packetbeat-8-5-high-cpu-usage-after-updade-from-7-17-7/320058 "2022-11-29T14:50:15Z")
After packetbeat update from 7.17.7 to 8.5.0 all our hosts show high CPU usage. Packetbeat used only for DNS traffic screening. Even after we enabled only ICMP in config we see more than 15% CPU usage but before it was … --- ## [One of the nodes disk usage is almost full](https://discuss.elastic.co/t/one-of-the-nodes-disk-usage-is-almost-full/318977)
**Author:** [@catadetest](https://discuss.elastic.co/u/catadetest)\ **Replies:** 8\ **Last updated:** [November 29, 2022, 2:44pm UTC](https://discuss.elastic.co/t/one-of-the-nodes-disk-usage-is-almost-full/318977 "2022-11-29T14:44:39Z")
We have 3 nodes in an elasticsearch cluster on version: 6.8.21 All of them are master and data nodes. Today, we observed that one node disk usage is almost full (88%), while the others are only 13%, 25% used. curl -s … --- ## [Wildcard queries slow since ES 5.x](https://discuss.elastic.co/t/wildcard-queries-slow-since-es-5-x/320054)
**Author:** [@nesretep](https://discuss.elastic.co/u/nesretep)\ **Replies:** 1\ **Last updated:** [November 29, 2022, 2:33pm UTC](https://discuss.elastic.co/t/wildcard-queries-slow-since-es-5-x/320054 "2022-11-29T14:33:18Z")
Hi there In the past, to my knowledge untill ES 6, queries - especially wildcard queries - were in general blisteringly fast. Since then, performance has degraded dramatically, with small improvements up through ES 7 an… --- ## [Error when exporting more than 1000 saved objects](https://discuss.elastic.co/t/error-when-exporting-more-than-1000-saved-objects/317497)
**Author:** [@jonas27](https://discuss.elastic.co/u/jonas27)\ **Replies:** 7\ **Last updated:** [November 2, 2022, 12:57pm UTC](https://discuss.elastic.co/t/error-when-exporting-more-than-1000-saved-objects/317497 "2022-11-02T12:57:58Z")
Hi, I am hitting an error in our infrastructure when exporting more than =\< 1000 saved objects (visualizations in particular) from either the API or inside the dev tools. However, when exporting the same objects via a li… --- ## ["TypeError: You provided 'undefined' where a stream was expected. You can provide an Observable](https://discuss.elastic.co/t/typeerror-you-provided-undefined-where-a-stream-was-expected-you-can-provide-an-observable/320056)
**Author:** [@Rajitha\_Bizz](https://discuss.elastic.co/u/Rajitha_Bizz)\ **Replies:** 0\ **Last updated:** [November 29, 2022, 2:12pm UTC](https://discuss.elastic.co/t/typeerror-you-provided-undefined-where-a-stream-was-expected-you-can-provide-an-observable/320056 "2022-11-29T14:12:38Z")
I facing this issue when we update kibana from 7.10.2 to 7.17.7. It is kind of strange behavior, there is a nginx proxy in between. {"type":"log","@timestamp":"2022-11-29T13:32:08+00:00","tags":\["error","http"\],"pid":2… --- ## [LiteSpeed Webserver Monitor](https://discuss.elastic.co/t/litespeed-webserver-monitor/320047)
**Author:** [@acosta353](https://discuss.elastic.co/u/acosta353)\ **Replies:** 0\ **Last updated:** [November 29, 2022, 1:25pm UTC](https://discuss.elastic.co/t/litespeed-webserver-monitor/320047 "2022-11-29T13:25:05Z")
Hello, Is there any way to monitor (filebeat and most important with metricbeats) a litespeed Webserver? I would like to have some graphs with statistics of number of requests, and other things as we have in Apache and… --- ## [Custom Ingest Pipeline](https://discuss.elastic.co/t/custom-ingest-pipeline/319316)
**Author:** [@acosta353](https://discuss.elastic.co/u/acosta353)\ **Replies:** 2\ **Last updated:** [November 29, 2022, 1:22pm UTC](https://discuss.elastic.co/t/custom-ingest-pipeline/319316 "2022-11-29T13:22:27Z")
Hello, I'm new to Elastic, and I'm trying to search how to configure properly a custom ingest pipeline to Apache integration. In fact, I need to add some different groks and time formats so that some logs can be parsed… --- ## [Elasticsearch search querry](https://discuss.elastic.co/t/elasticsearch-search-querry/320021)
**Author:** [@Ali5](https://discuss.elastic.co/u/Ali5)\ **Replies:** 4\ **Last updated:** [November 29, 2022, 11:56am UTC](https://discuss.elastic.co/t/elasticsearch-search-querry/320021 "2022-11-29T11:56:35Z")
GET products/\_search { "query": { "multi\_match" : { "query": "novel", "fields": \[ "description", "name","id" ,"price"\] } } } this is the querry which get my results done i want to convert it into java api in … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=715) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=717)