# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=805 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 806 --- ## [Popular Fields](https://discuss.elastic.co/t/popular-fields/312827)
**Author:** [@tepus](https://discuss.elastic.co/u/tepus)\ **Replies:** 2\ **Last updated:** [September 6, 2022, 10:05am UTC](https://discuss.elastic.co/t/popular-fields/312827 "2022-09-06T10:05:36Z")
Hello Community, there are Popular fields collected out from the Available Fields on the left-hand side of Discover in Kibana. The customer wants them to be adjusted to each user as well as to each data view. Therefore… --- ## [What is the Watcher's logs location?](https://discuss.elastic.co/t/what-is-the-watchers-logs-location/313776)
**Author:** [@Dr.Antarctica](https://discuss.elastic.co/u/Dr.Antarctica)\ **Replies:** 0\ **Last updated:** [September 6, 2022, 10:02am UTC](https://discuss.elastic.co/t/what-is-the-watchers-logs-location/313776 "2022-09-06T10:02:24Z")
Hi, I'm using Watchers on Kibana to alert me via e-mail. I tried to add the logging action, but can't find where the messages are logged. Do I need to do anything else to access them? I can find the Watcher's audit log… --- ## [Can't set up index lifecycle correctly](https://discuss.elastic.co/t/cant-set-up-index-lifecycle-correctly/313768)
**Author:** [@fetchbak](https://discuss.elastic.co/u/fetchbak)\ **Replies:** 0\ **Last updated:** [September 6, 2022, 8:47am UTC](https://discuss.elastic.co/t/cant-set-up-index-lifecycle-correctly/313768 "2022-09-06T08:47:48Z")
Hi there! I'm trying to set up the lifecycle of my indexes and I'm getting the following error: "Index lifecycle error illegal\_argument\_exception: index.lifecycle.rollover\_alias \[test-alias\] does not point to index \[t… --- ## [Filter JSON message in kibana](https://discuss.elastic.co/t/filter-json-message-in-kibana/312535)
**Author:** [@imkinnu](https://discuss.elastic.co/u/imkinnu)\ **Replies:** 1\ **Last updated:** [September 6, 2022, 9:41am UTC](https://discuss.elastic.co/t/filter-json-message-in-kibana/312535 "2022-09-06T09:41:16Z")
Hi, My JSON file looks like this. I want a filter on Kibana for the JSON object I am passing through logstash. For example { "\_index": "mule-logs", "\_type": "\_doc", "\_id": "S\_gavoIBvzaqpVvKmITM", "\_score": 1, … --- ## [Transferring documents from different ES servers](https://discuss.elastic.co/t/transferring-documents-from-different-es-servers/313773)
**Author:** [@Ivo\_Tavares](https://discuss.elastic.co/u/Ivo_Tavares)\ **Replies:** 0\ **Last updated:** [September 6, 2022, 9:38am UTC](https://discuss.elastic.co/t/transferring-documents-from-different-es-servers/313773 "2022-09-06T09:38:42Z")
I'm trying to transfer some documents from a source server to a destination server. Both have the same settings, and indices associated to those documents. The documents have an object data field, that inherits from an … --- ## [Making rows clickable in enhanced table kibana](https://discuss.elastic.co/t/making-rows-clickable-in-enhanced-table-kibana/312174)
**Author:** [@dchaarifreedomofdev](https://discuss.elastic.co/u/dchaarifreedomofdev)\ **Replies:** 1\ **Last updated:** [September 6, 2022, 9:38am UTC](https://discuss.elastic.co/t/making-rows-clickable-in-enhanced-table-kibana/312174 "2022-09-06T09:38:18Z")
Hi! I'm using version 7.16.3 of Kibana and I'm using the plugin enhanced-table it has great features but I was wondering if it also has the feature of clickable rows that could take me to a different dashboard or a disco… --- ## [Endpoint Security integration and index naming (.logs-endpoint.action.responses)](https://discuss.elastic.co/t/endpoint-security-integration-and-index-naming-logs-endpoint-action-responses/313744)
**Author:** [@ivo.raisr](https://discuss.elastic.co/u/ivo.raisr)\ **Replies:** 1\ **Last updated:** [September 6, 2022, 9:33am UTC](https://discuss.elastic.co/t/endpoint-security-integration-and-index-naming-logs-endpoint-action-responses/313744 "2022-09-06T09:33:59Z")
"Endpoint and Cloud Security" integration for Elastic Agent mentions in the documentation (for Elastic 8.4.1) that ...The log type of documents are stored in the logs-endpoint.\* indices. ... However this is not entirel… --- ## [Migration from AWS opensearch to elasticsearch](https://discuss.elastic.co/t/migration-from-aws-opensearch-to-elasticsearch/313763)
**Author:** [@mkgupta](https://discuss.elastic.co/u/mkgupta)\ **Replies:** 2\ **Last updated:** [September 6, 2022, 9:21am UTC](https://discuss.elastic.co/t/migration-from-aws-opensearch-to-elasticsearch/313763 "2022-09-06T09:21:08Z")
Hi , I want to migrate indices of aws opensearch version 1.2 to Elasticsearch version 7.10. Is it possible to migrate or not? I am facing the version issue when trying to migrate. --- ## [Timeseries data with ILM and out of sequence write/delete of older data](https://discuss.elastic.co/t/timeseries-data-with-ilm-and-out-of-sequence-write-delete-of-older-data/313459)
**Author:** [@kk123](https://discuss.elastic.co/u/kk123)\ **Replies:** 4\ **Last updated:** [September 6, 2022, 9:06am UTC](https://discuss.elastic.co/t/timeseries-data-with-ilm-and-out-of-sequence-write-delete-of-older-data/313459 "2022-09-06T09:06:19Z")
Hi, this question is a follow on from a Previous post. I am looking to merge many indices into 1 and using ILM to manage index size etc. However what happens if I have to update or delete a document in an index that is … --- ## [TImezone in Elasticsearch logs](https://discuss.elastic.co/t/timezone-in-elasticsearch-logs/313540)
**Author:** [@cheshirecat](https://discuss.elastic.co/u/cheshirecat)\ **Replies:** 6\ **Last updated:** [September 6, 2022, 8:49am UTC](https://discuss.elastic.co/t/timezone-in-elasticsearch-logs/313540 "2022-09-06T08:49:00Z")
Hello There! I see that my logs for Elasticsearch have different timezone that my server. For my server I have got set timezone: 'pią' is shortcut for 'piątek' that means 'Friday' in Polish. My logs however got UTC… --- ## [Duplicatehandling: Only upload unique documents](https://discuss.elastic.co/t/duplicatehandling-only-upload-unique-documents/313674)
**Author:** [@Clonky](https://discuss.elastic.co/u/Clonky)\ **Replies:** 4\ **Last updated:** [September 6, 2022, 8:38am UTC](https://discuss.elastic.co/t/duplicatehandling-only-upload-unique-documents/313674 "2022-09-06T08:38:16Z")
Hello guys, I have the following situation: I am uploading time sensitive data to Elastic. The folder which gets opened by the parsing and upload script contains all the files which I want to upload. However, in this f… --- ## [Elasticsearch java client for search API not querying all ES Nodes](https://discuss.elastic.co/t/elasticsearch-java-client-for-search-api-not-querying-all-es-nodes/312673)
**Author:** [@pratikshatiwari](https://discuss.elastic.co/u/pratikshatiwari)\ **Replies:** 14\ **Last updated:** [September 6, 2022, 8:23am UTC](https://discuss.elastic.co/t/elasticsearch-java-client-for-search-api-not-querying-all-es-nodes/312673 "2022-09-06T08:23:53Z")
Hello Environment detail - We are having Elasticsearch cluster with version 8.3 with 3 masternode, also we have search API setup with elasticsearch java client to query the data from Elasticsearch using rest client. S… --- ## [Issue with provision large file to logstash](https://discuss.elastic.co/t/issue-with-provision-large-file-to-logstash/313719)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 1\ **Last updated:** [September 6, 2022, 7:32am UTC](https://discuss.elastic.co/t/issue-with-provision-large-file-to-logstash/313719 "2022-09-06T07:32:03Z")
Hi I'm facing with case with large file (~800MB) during transfer to logstash Indeed this is a case where data doesn't match in order This case has begun on (Csv plugin cooperating with multiplying pattern - #11 by Bad… --- ## [\`block in start\_input\` appears when trying to run logstash input using jdbc plugin](https://discuss.elastic.co/t/block-in-start-input-appears-when-trying-to-run-logstash-input-using-jdbc-plugin/313697)
**Author:** [@Khammassi\_HoussemEdd](https://discuss.elastic.co/u/Khammassi_HoussemEdd)\ **Replies:** 2\ **Last updated:** [September 6, 2022, 7:49am UTC](https://discuss.elastic.co/t/block-in-start-input-appears-when-trying-to-run-logstash-input-using-jdbc-plugin/313697 "2022-09-06T07:49:09Z")
Hello i have a mysql database and i want to ingest it's data into elasticsearch using logstash after configuring the input and output i am getting the following error: org/jruby/RubyArray.java:1865:in \`each' /usr/share… --- ## [Kibana Title rename](https://discuss.elastic.co/t/kibana-title-rename/313147)
**Author:** [@Yustas](https://discuss.elastic.co/u/Yustas)\ **Replies:** 4\ **Last updated:** [September 6, 2022, 7:49am UTC](https://discuss.elastic.co/t/kibana-title-rename/313147 "2022-09-06T07:49:03Z")
Hello Does anybody know how to change Kibana Title? I need to work together with two Elastic cluster. Test and Production cluster's. Create/Edit on Test cluster and push changes after cheking to production cluster. B… --- ## [How to use subnet in hosts field of metricbeat modules](https://discuss.elastic.co/t/how-to-use-subnet-in-hosts-field-of-metricbeat-modules/313758)
**Author:** [@maheshmotukuri](https://discuss.elastic.co/u/maheshmotukuri)\ **Replies:** 0\ **Last updated:** [September 6, 2022, 7:46am UTC](https://discuss.elastic.co/t/how-to-use-subnet-in-hosts-field-of-metricbeat-modules/313758 "2022-09-06T07:46:13Z")
Would like to use subnet of hosts for collecting metrics from Prometheus exporter instead of list of IP's in hosts collection. currently it supports metricbeat.modules: - module: prometheus period: 10s metricsets: … --- ## [How update, update\_by\_query in ES really work?](https://discuss.elastic.co/t/how-update-update-by-query-in-es-really-work/313727)
**Author:** [@robocon20x](https://discuss.elastic.co/u/robocon20x)\ **Replies:** 7\ **Last updated:** [September 6, 2022, 7:35am UTC](https://discuss.elastic.co/t/how-update-update-by-query-in-es-really-work/313727 "2022-09-06T07:35:46Z")
Hi everyone, i'm trying to optimize update speed on my ES and want to know deeper about it's update and update\_by\_query. So I have some question: how update in elasticsearch really word. As I know when I update 1 doc, … --- ## [Urgent Help : How to Parse nested XML (Key value patterns) with multiple Parent children](https://discuss.elastic.co/t/urgent-help-how-to-parse-nested-xml-key-value-patterns-with-multiple-parent-children/312546)
**Author:** [@sonirajil](https://discuss.elastic.co/u/sonirajil)\ **Replies:** 4\ **Last updated:** [September 6, 2022, 7:30am UTC](https://discuss.elastic.co/t/urgent-help-how-to-parse-nested-xml-key-value-patterns-with-multiple-parent-children/312546 "2022-09-06T07:30:14Z")
Hello Community, I have minimal exp. in xml logstash parsing stuff. I have explored various discussions , one such which matches a bit to my case is : \[SOLVED\] Split filter question a.k.a flatten json sub array - #10 b… --- ## [Adding Snapshot S3 ECK elastic 8.4.1 cause 302 error](https://discuss.elastic.co/t/adding-snapshot-s3-eck-elastic-8-4-1-cause-302-error/313752)
**Author:** [@moscardo](https://discuss.elastic.co/u/moscardo)\ **Replies:** 0\ **Last updated:** [September 6, 2022, 7:21am UTC](https://discuss.elastic.co/t/adding-snapshot-s3-eck-elastic-8-4-1-cause-302-error/313752 "2022-09-06T07:21:01Z")
Hi, I am passing the secrets of the repo to the keystore like: spec: secureSettings: - secretName: s3-secret entries: - key: access-key path: s3.client.default.access\_key - key: secret-key p… --- ## [How to visualising availability metric in histogram](https://discuss.elastic.co/t/how-to-visualising-availability-metric-in-histogram/313720)
**Author:** [@amitrovic](https://discuss.elastic.co/u/amitrovic)\ **Replies:** 1\ **Last updated:** [September 6, 2022, 7:16am UTC](https://discuss.elastic.co/t/how-to-visualising-availability-metric-in-histogram/313720 "2022-09-06T07:16:31Z")
We are trying to visualise an availability value in Kibana but haven't been able to so for when there are multiple values for the same period. We have a service, i.e. telephony, we measure how many users are using the … --- ## [Exiting: data path already locked by another beat. Please make sure that multiple beats are not sharing the same data path (path.data)](https://discuss.elastic.co/t/exiting-data-path-already-locked-by-another-beat-please-make-sure-that-multiple-beats-are-not-sharing-the-same-data-path-path-data/313546)
**Author:** [@Sargu\_Xcode](https://discuss.elastic.co/u/Sargu_Xcode)\ **Replies:** 2\ **Last updated:** [September 6, 2022, 7:10am UTC](https://discuss.elastic.co/t/exiting-data-path-already-locked-by-another-beat-please-make-sure-that-multiple-beats-are-not-sharing-the-same-data-path-path-data/313546 "2022-09-06T07:10:10Z")
hello everyone , i am new to ELK , was trying to setup ELK with Auditbeat to monitor linux auditd logs, but it seems to break. kibana is not showing desired output and when attempted to check i got this log . appreciate… --- ## [Deploy Winlogbeat with SCCM](https://discuss.elastic.co/t/deploy-winlogbeat-with-sccm/313746)
**Author:** [@ivan\_Rivas](https://discuss.elastic.co/u/ivan_Rivas)\ **Replies:** 0\ **Last updated:** [September 6, 2022, 6:45am UTC](https://discuss.elastic.co/t/deploy-winlogbeat-with-sccm/313746 "2022-09-06T06:45:07Z")
Hi, I am trying to install a winlogbeat with SCCM and when I launch the package everything seems fine, but when I search for the winlogbeat service, it says it does not exist. Does anyone know what could be the reason? … --- ## [Yarn es snapshot --license trial Elasticsearch8.5 snapshot for starting Kibana as a developer](https://discuss.elastic.co/t/yarn-es-snapshot-license-trial-elasticsearch8-5-snapshot-for-starting-kibana-as-a-developer/313743)
**Author:** [@Aurangzeb099](https://discuss.elastic.co/u/Aurangzeb099)\ **Replies:** 0\ **Last updated:** [September 6, 2022, 6:29am UTC](https://discuss.elastic.co/t/yarn-es-snapshot-license-trial-elasticsearch8-5-snapshot-for-starting-kibana-as-a-developer/313743 "2022-09-06T06:29:05Z")
To create a custom plugin, not as root I cloned the kibana git hub repo yarn kbn bootstrap ----\> was successful The next step as per the documentation, (Getting started | Kibana Guide \[master\] | Elastic) yarn es sn… --- ## [Error: fail to communicate with updated API client hosts](https://discuss.elastic.co/t/error-fail-to-communicate-with-updated-api-client-hosts/313525)
**Author:** [@ethical20](https://discuss.elastic.co/u/ethical20)\ **Replies:** 2\ **Last updated:** [September 6, 2022, 6:37am UTC](https://discuss.elastic.co/t/error-fail-to-communicate-with-updated-api-client-hosts/313525 "2022-09-06T06:37:41Z")
Hi All, I have a self managed fleet server with one local machine connecting perfectly and i can see logs. I've installed a new remote cloud machine, the installation was successful but I can't see logs coming. Checki… --- ## [If there's a way to use scroll\_id in sql?](https://discuss.elastic.co/t/if-theres-a-way-to-use-scroll-id-in-sql/313739)
**Author:** [@Zengweilu](https://discuss.elastic.co/u/Zengweilu)\ **Replies:** 0\ **Last updated:** [September 6, 2022, 6:20am UTC](https://discuss.elastic.co/t/if-theres-a-way-to-use-scroll-id-in-sql/313739 "2022-09-06T06:20:24Z")
How to use scroll query with JDBC SQL --- ## [Elasticsearch G1GC tuning Memory increases continuously](https://discuss.elastic.co/t/elasticsearch-g1gc-tuning-memory-increases-continuously/313689)
**Author:** [@M\_Khaled](https://discuss.elastic.co/u/M_Khaled)\ **Replies:** 5\ **Last updated:** [September 6, 2022, 5:54am UTC](https://discuss.elastic.co/t/elasticsearch-g1gc-tuning-memory-increases-continuously/313689 "2022-09-06T05:54:00Z")
Hi Guys, We are using Elasticsearch 8.2.0 with single node cluster, have added min/max heap as 30GB on a server with 128GB memory. We have around 1TB of index, the memory usage keeps on increasing in few hours and reach… --- ## [Error when setting up data streams](https://discuss.elastic.co/t/error-when-setting-up-data-streams/313420)
**Author:** [@anon90868141](https://discuss.elastic.co/u/anon90868141)\ **Replies:** 2\ **Last updated:** [September 6, 2022, 5:21am UTC](https://discuss.elastic.co/t/error-when-setting-up-data-streams/313420 "2022-09-06T05:21:31Z")
Hello, currently, we're using daily indices for logging events and I want to change that to data streams. I followed the steps out of the elasticsearch engineer course and also from the site "Set up a data stream". Whe… --- ## [How to calculate the estimated size (estimated\_size) of "Parent Circuit Breaker](https://discuss.elastic.co/t/how-to-calculate-the-estimated-size-estimated-size-of-parent-circuit-breaker/313733)
**Author:** [@yusuke.kominami](https://discuss.elastic.co/u/yusuke.kominami)\ **Replies:** 0\ **Last updated:** [September 6, 2022, 5:01am UTC](https://discuss.elastic.co/t/how-to-calculate-the-estimated-size-estimated-size-of-parent-circuit-breaker/313733 "2022-09-06T05:01:28Z")
Currently, \_nodes/stats are in the state attached below. As it is, it is caught in the limit of Parent Ciruit Breaker, which causes a Circuit Break. I would like to know how to deal with this. I am aware that the Pare… --- ## [Winlogbeat: missing data in user\_data field](https://discuss.elastic.co/t/winlogbeat-missing-data-in-user-data-field/313730)
**Author:** [@apawlowski](https://discuss.elastic.co/u/apawlowski)\ **Replies:** 0\ **Last updated:** [September 6, 2022, 4:47am UTC](https://discuss.elastic.co/t/winlogbeat-missing-data-in-user-data-field/313730 "2022-09-06T04:47:19Z")
Hi, we are trying to ship event ID 81 of the channel "Microsoft-Windows-CAPI2". However, we realized that data is missing. The actual event in the Windows event log looks like this: - \ **Author:** [@mancharagopan](https://discuss.elastic.co/u/mancharagopan)\ **Replies:** 1\ **Last updated:** [September 6, 2022, 4:44am UTC](https://discuss.elastic.co/t/crowdstrike-integration-with-elastic-agent/312332 "2022-09-06T04:44:11Z") I am planning to integrate Crowdstrike with Elastic stack using elastic agent. I have installed Elasticsearch and Kibana 8.3 successfully with security enabled. This is my first time working with elastic agent. Can someb… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=804) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=806)