# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=753 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 754 --- ## [Error while creating Snapshots](https://discuss.elastic.co/t/error-while-creating-snapshots/317366)
**Author:** [@selvaraj-sembulingam](https://discuss.elastic.co/u/selvaraj-sembulingam)\ **Replies:** 1\ **Last updated:** [October 25, 2022, 12:43pm UTC](https://discuss.elastic.co/t/error-while-creating-snapshots/317366 "2022-10-25T12:43:31Z")
Getting the following error while creating snapshots INTERNAL\_SERVER\_ERROR: java.lang.IllegalStateException: Could not find a readable index-N file in a non-empty shard snapshot directory \[\[indices\]\[qduDEnw9Se6TrncgbEZB… --- ## [Automatic skipping of indexes / shards for date-based indexing and index sorting](https://discuss.elastic.co/t/automatic-skipping-of-indexes-shards-for-date-based-indexing-and-index-sorting/317399)
**Author:** [@jojo23](https://discuss.elastic.co/u/jojo23)\ **Replies:** 2\ **Last updated:** [October 25, 2022, 11:37am UTC](https://discuss.elastic.co/t/automatic-skipping-of-indexes-shards-for-date-based-indexing-and-index-sorting/317399 "2022-10-25T11:37:45Z")
I run an Elasticsearch cluster with dozens of time-based monthly indexes and 240+ shards. Query performance is always a priority, so I have been wondering if there are ways to improve which indexes / shards are actually … --- ## [How to get the UUID of a document?](https://discuss.elastic.co/t/how-to-get-the-uuid-of-a-document/317401)
**Author:** [@wrobitza\_aveq](https://discuss.elastic.co/u/wrobitza_aveq)\ **Replies:** 1\ **Last updated:** [October 25, 2022, 11:29am UTC](https://discuss.elastic.co/t/how-to-get-the-uuid-of-a-document/317401 "2022-10-25T11:29:30Z")
When I am indexing a document to Elasticsearch via Ruby, I am supplying a custom \_id field, e.g. analytics-development-foo\_18. I get the following response from ES: {"\_index"=\>"analytics-development-foo", "\_id"=\>"analy… --- ## [Increasing the number of index shards](https://discuss.elastic.co/t/increasing-the-number-of-index-shards/317377)
**Author:** [@ZahraZare](https://discuss.elastic.co/u/ZahraZare)\ **Replies:** 7\ **Last updated:** [October 25, 2022, 10:47am UTC](https://discuss.elastic.co/t/increasing-the-number-of-index-shards/317377 "2022-10-25T10:47:00Z")
Is it possible to change the number of shards of existing indices? How to do this with Python? --- ## [How to get log when running kibana as a developer](https://discuss.elastic.co/t/how-to-get-log-when-running-kibana-as-a-developer/316426)
**Author:** [@Sheereen](https://discuss.elastic.co/u/Sheereen)\ **Replies:** 2\ **Last updated:** [October 25, 2022, 10:54am UTC](https://discuss.elastic.co/t/how-to-get-log-when-running-kibana-as-a-developer/316426 "2022-10-25T10:54:42Z")
Hi, I am running kibana as a developer (in development mode). How and where can I get the log files when doing the same? Logging details in my kibana.yml My kibana working directory is /my\_work/kibana logging.dest: /… --- ## [Implement multi-tenancy for an external custom plugin](https://discuss.elastic.co/t/implement-multi-tenancy-for-an-external-custom-plugin/315655)
**Author:** [@Sheereen](https://discuss.elastic.co/u/Sheereen)\ **Replies:** 1\ **Last updated:** [October 25, 2022, 10:53am UTC](https://discuss.elastic.co/t/implement-multi-tenancy-for-an-external-custom-plugin/315655 "2022-10-25T10:53:17Z")
Hi I am developing my own external custom plugin in React. I want to implement multi-tenancy for the same. I believe the process to first create namespaces for each company and then give access to users of a particular… --- ## [Restrict access to Wazuh-kibana-plugin](https://discuss.elastic.co/t/restrict-access-to-wazuh-kibana-plugin/316280)
**Author:** [@Sheereen](https://discuss.elastic.co/u/Sheereen)\ **Replies:** 1\ **Last updated:** [October 25, 2022, 10:53am UTC](https://discuss.elastic.co/t/restrict-access-to-wazuh-kibana-plugin/316280 "2022-10-25T10:53:10Z")
Hi, I have installed Wazuh as a plugin in my Kibana instance. I want to restrict Wazuh access to a particular namespace and particular user roles only. How can I achieve the same? Thanks --- ## [Make custom plugin available based on role of user and in some namepsaces only](https://discuss.elastic.co/t/make-custom-plugin-available-based-on-role-of-user-and-in-some-namepsaces-only/315932)
**Author:** [@Sheereen](https://discuss.elastic.co/u/Sheereen)\ **Replies:** 2\ **Last updated:** [October 25, 2022, 10:51am UTC](https://discuss.elastic.co/t/make-custom-plugin-available-based-on-role-of-user-and-in-some-namepsaces-only/315932 "2022-10-25T10:51:51Z")
Hi I am creating a custom externally distributable plugin But I want the plugin to be installed in specific namespaces only and be available to users with specific roles only How can I implement it? I checked on Kiba… --- ## [Soundex phonetic not working](https://discuss.elastic.co/t/soundex-phonetic-not-working/317383)
**Author:** [@Nitin\_Dabadghav](https://discuss.elastic.co/u/Nitin_Dabadghav)\ **Replies:** 0\ **Last updated:** [October 25, 2022, 8:51am UTC](https://discuss.elastic.co/t/soundex-phonetic-not-working/317383 "2022-10-25T08:51:39Z")
I am trying to use phonetic's soundex encoder. I have an index which has a record for a name which has a string "Yangtze". If I try to search with a misspelled strings like "yangse", "yantse" or similar, I am unable to g… --- ## [Elastic score decay if field tokens are in another field](https://discuss.elastic.co/t/elastic-score-decay-if-field-tokens-are-in-another-field/316037)
**Author:** [@Sergey\_V](https://discuss.elastic.co/u/Sergey_V)\ **Replies:** 4\ **Last updated:** [October 25, 2022, 7:38am UTC](https://discuss.elastic.co/t/elastic-score-decay-if-field-tokens-are-in-another-field/316037 "2022-10-25T07:38:12Z")
Hi! Me need decrease score of document if in "field1" has tokens of "field2". Tell me how can this be done? --- ## [Split Document into multiple document based on condition](https://discuss.elastic.co/t/split-document-into-multiple-document-based-on-condition/316737)
**Author:** [@yuswanul](https://discuss.elastic.co/u/yuswanul)\ **Replies:** 19\ **Last updated:** [October 25, 2022, 6:54am UTC](https://discuss.elastic.co/t/split-document-into-multiple-document-based-on-condition/316737 "2022-10-25T06:54:47Z")
Hi there, i plan to split field into multiple document based on OID. So, i have configured snmp pipeline for my network device. I managed to monitor the cpu and memory usage but i'm facing problem when i want to monitor… --- ## [Fortinet integration not parsing all data](https://discuss.elastic.co/t/fortinet-integration-not-parsing-all-data/317369)
**Author:** [@sirineb](https://discuss.elastic.co/u/sirineb)\ **Replies:** 0\ **Last updated:** [October 25, 2022, 6:44am UTC](https://discuss.elastic.co/t/fortinet-integration-not-parsing-all-data/317369 "2022-10-25T06:44:37Z")
Hi, I posted a topic in the category Elastic Stack Beats as it was advised to do with issues regarding the Elastic Agent. But I am struggling having an answer, so I paste here, in the category Elastic Stack Elastic Agen… --- ## [Visio stencils](https://discuss.elastic.co/t/visio-stencils/317368)
**Author:** [@bering](https://discuss.elastic.co/u/bering)\ **Replies:** 0\ **Last updated:** [October 25, 2022, 6:20am UTC](https://discuss.elastic.co/t/visio-stencils/317368 "2022-10-25T06:20:09Z")
Some time ago I was able to download logos and other Elasic figures that could be imported into Visio from this link Trademarks found on Elastic.co | Elastic but that now links to some trademark page. Does anyone know w… --- ## [How to get nested field value equal to keyword field value](https://discuss.elastic.co/t/how-to-get-nested-field-value-equal-to-keyword-field-value/317360)
**Author:** [@casterQ](https://discuss.elastic.co/u/casterQ)\ **Replies:** 0\ **Last updated:** [October 25, 2022, 2:58am UTC](https://discuss.elastic.co/t/how-to-get-nested-field-value-equal-to-keyword-field-value/317360 "2022-10-25T02:58:31Z")
can i get b value in nested script query? PUT test { "mappings": { "properties": { "b": { "type": "keyword" }, "nested": { "type": "nested", "properties": { "a":… --- ## [Using Prometheus remote\_write to send metrics to Elastic cloud](https://discuss.elastic.co/t/using-prometheus-remote-write-to-send-metrics-to-elastic-cloud/317014)
**Author:** [@Maduranga](https://discuss.elastic.co/u/Maduranga)\ **Replies:** 6\ **Last updated:** [October 25, 2022, 1:48am UTC](https://discuss.elastic.co/t/using-prometheus-remote-write-to-send-metrics-to-elastic-cloud/317014 "2022-10-25T01:48:41Z")
Hello, I have a Prometheus server which is sending currently sending metrics to Grafana using remote\_write. I would like to use our Elastic cloud Kibana to get the Prometheus metrics. Would like advice on how to authe… --- ## [How to display custom calculated machine learning metrics on Kibana dashboard?](https://discuss.elastic.co/t/how-to-display-custom-calculated-machine-learning-metrics-on-kibana-dashboard/317330)
**Author:** [@Suraj\_Manjunatha](https://discuss.elastic.co/u/Suraj_Manjunatha)\ **Replies:** 0\ **Last updated:** [October 24, 2022, 3:13pm UTC](https://discuss.elastic.co/t/how-to-display-custom-calculated-machine-learning-metrics-on-kibana-dashboard/317330 "2022-10-24T15:13:52Z")
Hello, I have a ML model for image classification problem running on Azure Kubernetes instance on python. I would like to visualize some model metrics like precision, accuracy, recall etc. on a kibana dashboard. With ev… --- ## [Solving version\_conflict\_engine\_exception on update](https://discuss.elastic.co/t/solving-version-conflict-engine-exception-on-update/317337)
**Author:** [@OranShuster](https://discuss.elastic.co/u/OranShuster)\ **Replies:** 9\ **Last updated:** [October 24, 2022, 8:31pm UTC](https://discuss.elastic.co/t/solving-version-conflict-engine-exception-on-update/317337 "2022-10-24T20:31:46Z")
Preface - Cluster is running version 6.8 and we are doing a mix of search/create/update using the NodeJS Operations can access the same document in quick succession/concurrently since its based off events coming from k… --- ## [Can I use discovery-ec2 plugin for finding data node?](https://discuss.elastic.co/t/can-i-use-discovery-ec2-plugin-for-finding-data-node/317331)
**Author:** [@qksjdhi1212](https://discuss.elastic.co/u/qksjdhi1212)\ **Replies:** 1\ **Last updated:** [October 24, 2022, 8:24pm UTC](https://discuss.elastic.co/t/can-i-use-discovery-ec2-plugin-for-finding-data-node/317331 "2022-10-24T20:24:15Z")
First I wanted to use discovery-ec2 plugin to find nodes(including non-master-eligible nodes) easily in cluster but I've just noticed that discovery-ec2 plugin is only for finding master-eligible nodes on ES docs The d… --- ## [Filebeat on local laptop does not talk to the Elasticsearch (also on local laptop) - dial tcp \[::1\]:9200: connect: cannot assign requested address](https://discuss.elastic.co/t/filebeat-on-local-laptop-does-not-talk-to-the-elasticsearch-also-on-local-laptop-dial-tcp-1-connect-cannot-assign-requested-address/317145)
**Author:** [@ppine7](https://discuss.elastic.co/u/ppine7)\ **Replies:** 6\ **Last updated:** [October 24, 2022, 8:13pm UTC](https://discuss.elastic.co/t/filebeat-on-local-laptop-does-not-talk-to-the-elasticsearch-also-on-local-laptop-dial-tcp-1-connect-cannot-assign-requested-address/317145 "2022-10-24T20:13:24Z")
Hi, I am trying to setup Elsticsearch 8, Kibana and Filebeat 8 all on my local laptop, using this guide: I've got ES and Kibana running in Docker containers and communicating just fine. Next, I want to send events fr… --- ## [Can we delay output to Elasticsearch in batch?](https://discuss.elastic.co/t/can-we-delay-output-to-elasticsearch-in-batch/317137)
**Author:** [@quentin.legraverend](https://discuss.elastic.co/u/quentin.legraverend)\ **Replies:** 3\ **Last updated:** [October 24, 2022, 7:46pm UTC](https://discuss.elastic.co/t/can-we-delay-output-to-elasticsearch-in-batch/317137 "2022-10-24T19:46:20Z")
Hello, I have an Elastic stack self-managed in the cloud with a Fleet Server on it. I have a second environment on-premise with a really limited bandwidth and I want to have some Elastic Agents here also. My first ide… --- ## [Service account token elastic/kibana problemKibana not accessible from browser](https://discuss.elastic.co/t/service-account-token-elastic-kibana-problemkibana-not-accessible-from-browser/317333)
**Author:** [@EExisT](https://discuss.elastic.co/u/EExisT)\ **Replies:** 4\ **Last updated:** [October 24, 2022, 6:19pm UTC](https://discuss.elastic.co/t/service-account-token-elastic-kibana-problemkibana-not-accessible-from-browser/317333 "2022-10-24T18:19:52Z")
Hello, I was trying to start Kibana as a service, but I noticed that after a few seconds from the start Kibana goes down. In the /var/log/syslog file I saw this error: Oct 24 17:24:18 ubuntu-linux-22-04-desktop kibana… --- ## [Kibana visualize using unique count by latest records](https://discuss.elastic.co/t/kibana-visualize-using-unique-count-by-latest-records/316236)
**Author:** [@Ibrahim\_Z\_HIDIR](https://discuss.elastic.co/u/Ibrahim_Z_HIDIR)\ **Replies:** 2\ **Last updated:** [October 24, 2022, 5:29pm UTC](https://discuss.elastic.co/t/kibana-visualize-using-unique-count-by-latest-records/316236 "2022-10-24T17:29:55Z")
Hi all After some search and try, I could't find a way to solve my problem. I just want to display the counts of records depending of latest records of some repeating columns. For Example, the latest status of "A" i… --- ## [Is there an easy way to change the Lifecycle Policy of a Fleet managed data stream?](https://discuss.elastic.co/t/is-there-an-easy-way-to-change-the-lifecycle-policy-of-a-fleet-managed-data-stream/316941)
**Author:** [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Replies:** 2\ **Last updated:** [October 24, 2022, 4:09pm UTC](https://discuss.elastic.co/t/is-there-an-easy-way-to-change-the-lifecycle-policy-of-a-fleet-managed-data-stream/316941 "2022-10-24T16:09:18Z")
Hello, I'm starting to use the Fleet Server and the Elastic Agent to be able to use some integrations and because of that I'm also using data streams for the first time. I have a fleet server and one agent running wher… --- ## [How to use EXISTING multi-domain SSL cert to secure Kibana](https://discuss.elastic.co/t/how-to-use-existing-multi-domain-ssl-cert-to-secure-kibana/316934)
**Author:** [@Bitdoctor](https://discuss.elastic.co/u/Bitdoctor)\ **Replies:** 9\ **Last updated:** [October 24, 2022, 4:03pm UTC](https://discuss.elastic.co/t/how-to-use-existing-multi-domain-ssl-cert-to-secure-kibana/316934 "2022-10-24T16:03:00Z")
Simple case - the kibana guide to securing kibana with SSL assumes generating CSR 'from' Kibana server and submitting to SSL provider. I need instructions how to use my existing multi-domain certificate to secure Browser… --- ## [Failed to start Elasticsearch](https://discuss.elastic.co/t/failed-to-start-elasticsearch/317304)
**Author:** [@nicolas2603](https://discuss.elastic.co/u/nicolas2603)\ **Replies:** 9\ **Last updated:** [October 24, 2022, 3:12pm UTC](https://discuss.elastic.co/t/failed-to-start-elasticsearch/317304 "2022-10-24T15:12:52Z")
Hello. I'm having a problem with Elasticsearch, and I don't know much about Linux. It doesn't help! To run a mapping application (GeoNetwork), I need an instance of Elasticsearch. So I downloaded version 8.4.3 in tar.g… --- ## [Need help on syslog logstash input plugin](https://discuss.elastic.co/t/need-help-on-syslog-logstash-input-plugin/317181)
**Author:** [@niveditakathal](https://discuss.elastic.co/u/niveditakathal)\ **Replies:** 17\ **Last updated:** [October 24, 2022, 2:58pm UTC](https://discuss.elastic.co/t/need-help-on-syslog-logstash-input-plugin/317181 "2022-10-24T14:58:10Z")
Hi All, I have created a logstash pipeline to read the network syslog (RFC5424) data as mentioned below, However I don't see any output while running the pipeline. Can someone please assist me what I am missing. Note … --- ## [EQL correlation rule is timing out...sometimes](https://discuss.elastic.co/t/eql-correlation-rule-is-timing-out-sometimes/316641)
**Author:** [@gweiss76](https://discuss.elastic.co/u/gweiss76)\ **Replies:** 0\ **Last updated:** [October 14, 2022, 1:21pm UTC](https://discuss.elastic.co/t/eql-correlation-rule-is-timing-out-sometimes/316641 "2022-10-14T13:21:54Z")
Hi fellow log analysts We have a simple EQL correlation rule which we use to identify password changes on critical accounts (eventlog based). It looks like this: \[ any where event.code == "4624" \] by winlog.event\_data.… --- ## [Will PCRE regular expressions be supported in the future?](https://discuss.elastic.co/t/will-pcre-regular-expressions-be-supported-in-the-future/317322)
**Author:** [@shengwei.xu](https://discuss.elastic.co/u/shengwei.xu)\ **Replies:** 0\ **Last updated:** [October 24, 2022, 2:06pm UTC](https://discuss.elastic.co/t/will-pcre-regular-expressions-be-supported-in-the-future/317322 "2022-10-24T14:06:50Z")
Will PCRE regular expressions be supported in the future? I ran into a scenario that non-tech users only use PCRE regular expressions that most languages use, it's time-consuming for non-tech users to learn how to use el… --- ## [How to find the percentage for any query success?](https://discuss.elastic.co/t/how-to-find-the-percentage-for-any-query-success/317194)
**Author:** [@HemabhRavee](https://discuss.elastic.co/u/HemabhRavee)\ **Replies:** 1\ **Last updated:** [October 24, 2022, 12:38pm UTC](https://discuss.elastic.co/t/how-to-find-the-percentage-for-any-query-success/317194 "2022-10-24T12:38:21Z")
I want to write an aggregation which returns the percentage of hits for any query Let say I have a query Q which returns me 20 docs out of the 100 present in the target index. Then that aggregation should return me 20%… --- ## [Filter vs query](https://discuss.elastic.co/t/filter-vs-query/317297)
**Author:** [@Ismet](https://discuss.elastic.co/u/Ismet)\ **Replies:** 1\ **Last updated:** [October 24, 2022, 12:20pm UTC](https://discuss.elastic.co/t/filter-vs-query/317297 "2022-10-24T12:20:52Z")
Hi, can we use only filter without query and can we use query string with wildcard in filter. What are benefits of using only filter and using query string + filter? There is example of using only filter. Is this code o… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=752) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=754)