# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=741 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 742 --- ## [ElasticSearch deletes documents in an index automatically](https://discuss.elastic.co/t/elasticsearch-deletes-documents-in-an-index-automatically/318316)
**Author:** [@joanjanku2000](https://discuss.elastic.co/u/joanjanku2000)\ **Replies:** 19\ **Last updated:** [November 7, 2022, 11:51am UTC](https://discuss.elastic.co/t/elasticsearch-deletes-documents-in-an-index-automatically/318316 "2022-11-07T11:51:17Z")
I have configured an ELK Cluster with 5 nodes, one being master and the other slaves. I index logs in the cluster once a day using logstash. I use a CronJOB (script) to copy the log files to the configured logstash direc… --- ## [Avoiding data loss with filebeat in a K8S environment](https://discuss.elastic.co/t/avoiding-data-loss-with-filebeat-in-a-k8s-environment/318324)
**Author:** [@Ganapati\_Basimsetti](https://discuss.elastic.co/u/Ganapati_Basimsetti)\ **Replies:** 0\ **Last updated:** [November 7, 2022, 11:18am UTC](https://discuss.elastic.co/t/avoiding-data-loss-with-filebeat-in-a-k8s-environment/318324 "2022-11-07T11:18:07Z")
Hello There, We are in the process of setting up filebeat in the K8S environment running as a DaemonSet. We are evaluating the possibilities of data loss - logs generated by the application are not uploaded to Logstash … --- ## [Fleet Server & ES Agent](https://discuss.elastic.co/t/fleet-server-es-agent/318259)
**Author:** [@EExisT](https://discuss.elastic.co/u/EExisT)\ **Replies:** 4\ **Last updated:** [November 7, 2022, 11:11am UTC](https://discuss.elastic.co/t/fleet-server-es-agent/318259 "2022-11-07T11:11:51Z")
Hello, when I try to install the fleet server on the machine I receive this error: sudo ./elastic-agent install \\--fleet-server-es=http://10.211.55.7:9200 \\--fleet-server-service-token=AAEAAWVsYXN0aWMvZmxlZXQtc2VydmVyL… --- ## [How to merge multiple ml job using watcher](https://discuss.elastic.co/t/how-to-merge-multiple-ml-job-using-watcher/318149)
**Author:** [@minkiyo](https://discuss.elastic.co/u/minkiyo)\ **Replies:** 1\ **Last updated:** [November 7, 2022, 10:49am UTC](https://discuss.elastic.co/t/how-to-merge-multiple-ml-job-using-watcher/318149 "2022-11-07T10:49:21Z")
Would you explain how to make alert merging multiple ml job using watcher?? I heared that it can be send alert to correlates multiple machine learning jobs to find the influencer. --- ## [Missing terms in rollup\_search terms aggregations](https://discuss.elastic.co/t/missing-terms-in-rollup-search-terms-aggregations/318314)
**Author:** [@sam.hession](https://discuss.elastic.co/u/sam.hession)\ **Replies:** 0\ **Last updated:** [November 7, 2022, 10:27am UTC](https://discuss.elastic.co/t/missing-terms-in-rollup-search-terms-aggregations/318314 "2022-11-07T10:27:09Z")
Hello, This is a request for a follow-up on a previously posted topic, also documented and acknowledged in an issue on the ElasticSearch repo. My team has encountered this known issue with rollup\_search terms aggregati… --- ## [Malformed escape pair at index 54](https://discuss.elastic.co/t/malformed-escape-pair-at-index-54/318312)
**Author:** [@reed](https://discuss.elastic.co/u/reed)\ **Replies:** 0\ **Last updated:** [November 7, 2022, 10:06am UTC](https://discuss.elastic.co/t/malformed-escape-pair-at-index-54/318312 "2022-11-07T10:06:16Z")
Hi all, i have my http output plugin called so: http { url =\> "http://10.98.144.73:9200/loyd-strategyone-processcode-%{process-code}/\_update\_by\_query?conflicts=proceed" headers =\> { "Authorization" =\> "Basic Z… --- ## [Partial word search with free text search string in multiple fields](https://discuss.elastic.co/t/partial-word-search-with-free-text-search-string-in-multiple-fields/318311)
**Author:** [@Sagar\_Viradiya](https://discuss.elastic.co/u/Sagar_Viradiya)\ **Replies:** 0\ **Last updated:** [November 7, 2022, 10:02am UTC](https://discuss.elastic.co/t/partial-word-search-with-free-text-search-string-in-multiple-fields/318311 "2022-11-07T10:02:13Z")
Currently I am using multi\_match as below to search partial text string { "query": { "multi\_match": { "fields": \[ "model", "make", "year.keyword" … --- ## [Elastic Agents Unhealthy Status](https://discuss.elastic.co/t/elastic-agents-unhealthy-status/318310)
**Author:** [@EExisT](https://discuss.elastic.co/u/EExisT)\ **Replies:** 0\ **Last updated:** [November 7, 2022, 9:56am UTC](https://discuss.elastic.co/t/elastic-agents-unhealthy-status/318310 "2022-11-07T09:56:45Z")
Hello, I was trying Fleet and Elastic Agents. I enrolled a client, but the status is Unhealthy. Could u help me? Furthermore, I have no logs in the Kibana Dash. I gave this command for the Agent installation: .\\… --- ## [ES 7.16 Rolling up multiple date fields](https://discuss.elastic.co/t/es-7-16-rolling-up-multiple-date-fields/316510)
**Author:** [@sam.hession](https://discuss.elastic.co/u/sam.hession)\ **Replies:** 1\ **Last updated:** [November 7, 2022, 9:53am UTC](https://discuss.elastic.co/t/es-7-16-rolling-up-multiple-date-fields/316510 "2022-11-07T09:53:27Z")
Hello Team, I'm currently working with rollup jobs in ES 7.16.2 and I'm looking to group on multiple date properties. It seems that this isn't currently possible with the API only supporting a single data\_histogram fiel… --- ## [Information about ml result index](https://discuss.elastic.co/t/information-about-ml-result-index/318288)
**Author:** [@minkiyo](https://discuss.elastic.co/u/minkiyo)\ **Replies:** 1\ **Last updated:** [November 7, 2022, 9:22am UTC](https://discuss.elastic.co/t/information-about-ml-result-index/318288 "2022-11-07T09:22:19Z")
When I make ML Job, I could find 3 type of ml index. Would you explain exactly what index is for?? .ml-anomalies-.write-ml\_oap\_bucket\_3\_advanced\_multi\_metric .ml-anomalies-ml\_oap\_bucket\_3\_advanced\_multi\_metric .ml-ano… --- ## [Filebeat doesn't seem to create index](https://discuss.elastic.co/t/filebeat-doesnt-seem-to-create-index/318303)
**Author:** [@romakolesnikow](https://discuss.elastic.co/u/romakolesnikow)\ **Replies:** 3\ **Last updated:** [November 7, 2022, 9:09am UTC](https://discuss.elastic.co/t/filebeat-doesnt-seem-to-create-index/318303 "2022-11-07T09:09:15Z")
I have ELK setup on one server and logs i am trying to read on another. But on kibana i dont see index created from filebeat. Filebeat console output works properly and showing my logs. filebeat.yml: filebeat.inputs: -… --- ## [Need to display only row records that shows only MAX/MIN Value count among all the records.(Kibana table or Enhanced table)](https://discuss.elastic.co/t/need-to-display-only-row-records-that-shows-only-max-min-value-count-among-all-the-records-kibana-table-or-enhanced-table/318116)
**Author:** [@PRASHANT\_MEHTA](https://discuss.elastic.co/u/PRASHANT_MEHTA)\ **Replies:** 4\ **Last updated:** [November 7, 2022, 7:48am UTC](https://discuss.elastic.co/t/need-to-display-only-row-records-that-shows-only-max-min-value-count-among-all-the-records-kibana-table-or-enhanced-table/318116 "2022-11-07T07:48:46Z")
Hello All, I want to achieve this usecase where I just want to display only those records in kibana table whereI need to show only those row records with MAX/MIN count value. Kibana version 7.9.1,How can this be achiev… --- ## [How big should an index be for 2x data node cluster](https://discuss.elastic.co/t/how-big-should-an-index-be-for-2x-data-node-cluster/317531)
**Author:** [@landychev](https://discuss.elastic.co/u/landychev)\ **Replies:** 5\ **Last updated:** [November 7, 2022, 9:00am UTC](https://discuss.elastic.co/t/how-big-should-an-index-be-for-2x-data-node-cluster/317531 "2022-11-07T09:00:14Z")
I did a query at my elastic nodes today. curl -X GET "http://$IP:9200/\_cat/indices?v" I did see that i have some index that are 80-90Gb and some are smaller. Is that normal or do i have some wrong settings ? Does the… --- ## [Elasticsearch - Attempted to resurrect connection to dead ES instance, but got an error](https://discuss.elastic.co/t/elasticsearch-attempted-to-resurrect-connection-to-dead-es-instance-but-got-an-error/318291)
**Author:** [@Zay\_Lin\_Htun](https://discuss.elastic.co/u/Zay_Lin_Htun)\ **Replies:** 5\ **Last updated:** [November 7, 2022, 8:49am UTC](https://discuss.elastic.co/t/elasticsearch-attempted-to-resurrect-connection-to-dead-es-instance-but-got-an-error/318291 "2022-11-07T08:49:19Z")
My Logstash can not connect to Elastic Search. My Logstash beats.conf config input { beats { port =\> 5044 } } output { elasticsearch { hosts =\> \["18.00.00.00:9200"\] } stdout { codec =\> rubydebug } } My Fil… --- ## [Subqueries in Kibana it that posible?](https://discuss.elastic.co/t/subqueries-in-kibana-it-that-posible/315589)
**Author:** [@Jose\_Javier\_Marti\_Ca](https://discuss.elastic.co/u/Jose_Javier_Marti_Ca)\ **Replies:** 2\ **Last updated:** [October 10, 2022, 9:05am UTC](https://discuss.elastic.co/t/subqueries-in-kibana-it-that-posible/315589 "2022-10-10T09:05:08Z")
Hi I'm new in Elastic and do not know if it even can be possible. I'd like to perform this "query" i kibana. Select col1 from table1 t1 where NOT exists (select col1 from table1 t2 where t1.col1=t2.col1 and t1.date = … --- ## [Error 8.5.0 running as systemctl service](https://discuss.elastic.co/t/error-8-5-0-running-as-systemctl-service/318278)
**Author:** [@georgios.mpouras](https://discuss.elastic.co/u/georgios.mpouras)\ **Replies:** 2\ **Last updated:** [November 7, 2022, 8:37am UTC](https://discuss.elastic.co/t/error-8-5-0-running-as-systemctl-service/318278 "2022-11-07T08:37:28Z")
I have a new installation of logstash 8.5.0 at Alma 9 from the repo When I run logstash as user logstash from the command line everything works as expocted sudo -u logstash /usr/share/logstash/bin/logstash "--path.sett… --- ## [Remote Cluster](https://discuss.elastic.co/t/remote-cluster/317973)
**Author:** [@pankaj\_sharma1](https://discuss.elastic.co/u/pankaj_sharma1)\ **Replies:** 6\ **Last updated:** [November 7, 2022, 8:19am UTC](https://discuss.elastic.co/t/remote-cluster/317973 "2022-11-07T08:19:52Z")
HI all, after adding remote cluster in version of 8.2.2 . I'm getting list of remote cluster under the monitoring. --- ## [Rsyslog to remote elk](https://discuss.elastic.co/t/rsyslog-to-remote-elk/318100)
**Author:** [@Ayah](https://discuss.elastic.co/u/Ayah)\ **Replies:** 3\ **Last updated:** [November 7, 2022, 6:36am UTC](https://discuss.elastic.co/t/rsyslog-to-remote-elk/318100 "2022-11-07T06:36:36Z")
Dears, I am new in ELK, we have ELK system to collect logs from a radsecproxy.log in other server. the logstash is configured to accept radsecproxy log format only and shapping them. Now we need to forward same logs to… --- ## [How to remove transferred logs with Logstash?](https://discuss.elastic.co/t/how-to-remove-transferred-logs-with-logstash/318249)
**Author:** [@Vladimir\_Routine](https://discuss.elastic.co/u/Vladimir_Routine)\ **Replies:** 1\ **Last updated:** [November 7, 2022, 5:58am UTC](https://discuss.elastic.co/t/how-to-remove-transferred-logs-with-logstash/318249 "2022-11-07T05:58:21Z")
I want to use Logstash to move my log files from Mongodb to Elasticsearch. Is there any option to remove transferred logs from mongo? --- ## [Logstash not working fine](https://discuss.elastic.co/t/logstash-not-working-fine/318284)
**Author:** [@greeklegend](https://discuss.elastic.co/u/greeklegend)\ **Replies:** 5\ **Last updated:** [November 7, 2022, 5:27am UTC](https://discuss.elastic.co/t/logstash-not-working-fine/318284 "2022-11-07T05:27:48Z")
When I am trying to run as I am transferring data from csv file to Elasticsearch using logstash. My logstash.conf as follows input { file { path =\> "C:/Users/user/Downloads/abc/abc.csv" start\_position =\> "be… --- ## [How to know influencers list using query](https://discuss.elastic.co/t/how-to-know-influencers-list-using-query/318168)
**Author:** [@minkiyo](https://discuss.elastic.co/u/minkiyo)\ **Replies:** 3\ **Last updated:** [November 7, 2022, 3:57am UTC](https://discuss.elastic.co/t/how-to-know-influencers-list-using-query/318168 "2022-11-07T03:57:27Z")
When I query to ml result index (.ml-anomalies-\[job-id\]), I can see only influencers score. but I can not get influencers list. How can I get influencers list?? { "\_index" : ".ml-anomalies-shared", "\_t… --- ## [Important system indices](https://discuss.elastic.co/t/important-system-indices/318248)
**Author:** [@QuestBevan](https://discuss.elastic.co/u/QuestBevan)\ **Replies:** 1\ **Last updated:** [November 7, 2022, 3:40am UTC](https://discuss.elastic.co/t/important-system-indices/318248 "2022-11-07T03:40:32Z")
Hi All, Struggling to find a post detailing important system indices that should be backed up. Can someone provide a list of what should be backed up? My use case, is if our cluster was to corrupt, yes the data in it i… --- ## [Elaticsearch CCR \[Cross cluster replication\] Local setup](https://discuss.elastic.co/t/elaticsearch-ccr-cross-cluster-replication-local-setup/318190)
**Author:** [@Suraj\_Jannu](https://discuss.elastic.co/u/Suraj_Jannu)\ **Replies:** 1\ **Last updated:** [November 7, 2022, 3:30am UTC](https://discuss.elastic.co/t/elaticsearch-ccr-cross-cluster-replication-local-setup/318190 "2022-11-07T03:30:16Z")
Hello, I have two Elasticsearch instances running on my local machine with version \[7.5.1 and 8.4.3\]. Now I need to migrate the data from the old version instance to the new version instance. Question: Is CCR the co… --- ## [Windows-agnet encrypted communication configuration](https://discuss.elastic.co/t/windows-agnet-encrypted-communication-configuration/318227)
**Author:** [@monkey\_luffy](https://discuss.elastic.co/u/monkey_luffy)\ **Replies:** 3\ **Last updated:** [November 7, 2022, 3:21am UTC](https://discuss.elastic.co/t/windows-agnet-encrypted-communication-configuration/318227 "2022-11-07T03:21:46Z")
How do I configure the certificate path for windows-agnet encrypted communication? I have tried to change the yml file, but the Error message is "Error: yaml: line 20: did not find expected hexdecimal number". Please tel… --- ## [Why logstash crash](https://discuss.elastic.co/t/why-logstash-crash/318286)
**Author:** [@jin\_zhao](https://discuss.elastic.co/u/jin_zhao)\ **Replies:** 0\ **Last updated:** [November 7, 2022, 2:32am UTC](https://discuss.elastic.co/t/why-logstash-crash/318286 "2022-11-07T02:32:12Z")
error log \[2022-11-06T10:33:45,283\]\[ERROR\]\[logstash.javapipeline \]\[main\] Pipeline worker error, the pipeline will be stopped {:pipeline\_id=\>"main", :error=\>"(IOError) Resource temporarily unavailable", :exception=\>Ja… --- ## [Logstash issues/ is not working](https://discuss.elastic.co/t/logstash-issues-is-not-working/318265)
**Author:** [@Zay\_Lin\_Htun](https://discuss.elastic.co/u/Zay_Lin_Htun)\ **Replies:** 4\ **Last updated:** [November 7, 2022, 2:19am UTC](https://discuss.elastic.co/t/logstash-issues-is-not-working/318265 "2022-11-07T02:19:21Z")
There are three AWS EC2 instances. First one is Elasticsearch+ Kibana, Second one is logstash and third one UbuntuOS which will send logs to logstash. I deployed Elasticsearch and Kibana together on AWS EC2 instancens a… --- ## [Splitting for Logstash working intermittently](https://discuss.elastic.co/t/splitting-for-logstash-working-intermittently/318280)
**Author:** [@eleong](https://discuss.elastic.co/u/eleong)\ **Replies:** 2\ **Last updated:** [November 7, 2022, 2:08am UTC](https://discuss.elastic.co/t/splitting-for-logstash-working-intermittently/318280 "2022-11-07T02:08:49Z")
Hi, Currently, I have Logstash configured for splitting. The issue is that, sometimes it works, sometimes it goes about 10-15 minutes without any output (it suppose to have an output every 5 minutes). At the backend, I… --- ## [No name matching kunboy5240.tk found](https://discuss.elastic.co/t/no-name-matching-kunboy5240-tk-found/318103)
**Author:** [@a8840072](https://discuss.elastic.co/u/a8840072)\ **Replies:** 1\ **Last updated:** [November 7, 2022, 1:12am UTC](https://discuss.elastic.co/t/no-name-matching-kunboy5240-tk-found/318103 "2022-11-07T01:12:22Z")
I have configured the ssl certificate for my es, but when I want to reset the password, this exception occurs. I am sure that the"kunboy5240.tk" in the url I entered is my domain name used to generate the certificate , w… --- ## [Managing Master Nodes and Data Nodes](https://discuss.elastic.co/t/managing-master-nodes-and-data-nodes/318225)
**Author:** [@Zay\_Lin\_Htun](https://discuss.elastic.co/u/Zay_Lin_Htun)\ **Replies:** 5\ **Last updated:** [November 6, 2022, 4:14pm UTC](https://discuss.elastic.co/t/managing-master-nodes-and-data-nodes/318225 "2022-11-06T16:14:09Z")
Dear all, I am new to ELK Security and I am trying to implement ELK with master nodes and data nodes to handle massive amounts of data but I can not find the good documentation about my use case how to deploy and config… --- ## [ILM elasticsearch not working](https://discuss.elastic.co/t/ilm-elasticsearch-not-working/318263)
**Author:** [@alex\_96](https://discuss.elastic.co/u/alex_96)\ **Replies:** 2\ **Last updated:** [November 6, 2022, 4:06pm UTC](https://discuss.elastic.co/t/ilm-elasticsearch-not-working/318263 "2022-11-06T16:06:03Z")
Such a question, I read the manual and I seem to have done everything right, but I still get an error for indices, I use the wazuh template and add the following to it: { "order": 0, "index\_patterns": \[ "wazuh-a… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=740) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=742)