# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=844 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 845 --- ## [Elasticsearch Disaster Recovery](https://discuss.elastic.co/t/elasticsearch-disaster-recovery/311080)
**Author:** [@hjsroldan](https://discuss.elastic.co/u/hjsroldan)\ **Replies:** 7\ **Last updated:** [August 1, 2022, 10:32pm UTC](https://discuss.elastic.co/t/elasticsearch-disaster-recovery/311080 "2022-08-01T22:32:04Z")
Hi, Does anyone know how to perform/setup Elasticsearch Disaster Recovery? --- ## [Json for setting up new indices](https://discuss.elastic.co/t/json-for-setting-up-new-indices/311135)
**Author:** [@jhop](https://discuss.elastic.co/u/jhop)\ **Replies:** 7\ **Last updated:** [August 1, 2022, 10:09pm UTC](https://discuss.elastic.co/t/json-for-setting-up-new-indices/311135 "2022-08-01T22:09:30Z")
Sorry for the simple question but the documentation was not clear to me. I am using python to send data to elasticsearch. Should we always define an index before using json specifying this index to populate elasticsearc… --- ## [Installation Failed GCS Repo, Exception in thread "main" java.net.ConnectException: Connection timed out](https://discuss.elastic.co/t/installation-failed-gcs-repo-exception-in-thread-main-java-net-connectexception-connection-timed-out/310673)
**Author:** [@adilusmani](https://discuss.elastic.co/u/adilusmani)\ **Replies:** 2\ **Last updated:** [August 1, 2022, 8:55pm UTC](https://discuss.elastic.co/t/installation-failed-gcs-repo-exception-in-thread-main-java-net-connectexception-connection-timed-out/310673 "2022-08-01T20:55:32Z")
Hello, I am getting below error while installing Elasticsearch GCS plugin I am running the following command sudo ES\_JAVA\_OPTS="-Dhttp.proxyHost=\*\*\*\* -Dhttp.proxyPort=9200 Dhttps.proxyHost=\*\*\*\* -Dhttps.proxyPort=9200"… --- ## [Counting records missing from one month to another](https://discuss.elastic.co/t/counting-records-missing-from-one-month-to-another/310488)
**Author:** [@olivierl](https://discuss.elastic.co/u/olivierl)\ **Replies:** 22\ **Last updated:** [August 1, 2022, 7:38pm UTC](https://discuss.elastic.co/t/counting-records-missing-from-one-month-to-another/310488 "2022-08-01T19:38:49Z")
Hello there! I have a monthly interval in which I have multiple records with each 3 values: date email amount I'd like to be able to count all emails that simply disappear from a month to another (eg: customer leavin… --- ## [How to remove the value from the legend in TSVB](https://discuss.elastic.co/t/how-to-remove-the-value-from-the-legend-in-tsvb/310785)
**Author:** [@Kohlman](https://discuss.elastic.co/u/Kohlman)\ **Replies:** 3\ **Last updated:** [August 1, 2022, 6:10pm UTC](https://discuss.elastic.co/t/how-to-remove-the-value-from-the-legend-in-tsvb/310785 "2022-08-01T18:10:46Z")
I've created a number of TSVB visualizations. The latest had very large values. Which is when I noticed that the values are included in the legend. In addition, we like having the legend NOT truncated. This combination m… --- ## [Reinstall Elasticsearch 8.x (mistakes were made)](https://discuss.elastic.co/t/reinstall-elasticsearch-8-x-mistakes-were-made/311146)
**Author:** [@reswob](https://discuss.elastic.co/u/reswob)\ **Replies:** 1\ **Last updated:** [August 1, 2022, 6:02pm UTC](https://discuss.elastic.co/t/reinstall-elasticsearch-8-x-mistakes-were-made/311146 "2022-08-01T18:02:21Z")
noobish question: I am relearning elastic after a hiatus of a couple years. I downloaded the 8.3.3 tarball, uncompressed it and started elasticsearch, (I'm on linux) but I forgot to properly configure elasticsearch.yml… --- ## [Is there a way to write a query where x must be true AND y must be a + b, OR c + d?](https://discuss.elastic.co/t/is-there-a-way-to-write-a-query-where-x-must-be-true-and-y-must-be-a-b-or-c-d/311020)
**Author:** [@ccsisko](https://discuss.elastic.co/u/ccsisko)\ **Replies:** 2\ **Last updated:** [August 1, 2022, 6:00pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-write-a-query-where-x-must-be-true-and-y-must-be-a-b-or-c-d/311020 "2022-08-01T18:00:22Z")
Hello! We're writing a query where a couple fields must be true, while another field must equal something OR something else. More specifically, we're querying for a document that has a status of X, and the amount value … --- ## [GDAL not able to connect to Elastic Search](https://discuss.elastic.co/t/gdal-not-able-to-connect-to-elastic-search/308601)
**Author:** [@Purnima\_J](https://discuss.elastic.co/u/Purnima_J)\ **Replies:** 5\ **Last updated:** [August 1, 2022, 5:22pm UTC](https://discuss.elastic.co/t/gdal-not-able-to-connect-to-elastic-search/308601 "2022-08-01T17:22:38Z")
I am pretty new to Elasticsearch. I have installed both Elasticsearch and kibana. I am able to connect to Elasticsearch by https://localhost:9200. I am trying to ingest geospatial data as mentioned in this blog - How to… --- ## [Cannot generate report PDF or PNG](https://discuss.elastic.co/t/cannot-generate-report-pdf-or-png/311019)
**Author:** [@francescouk](https://discuss.elastic.co/u/francescouk)\ **Replies:** 6\ **Last updated:** [August 1, 2022, 4:50pm UTC](https://discuss.elastic.co/t/cannot-generate-report-pdf-or-png/311019 "2022-08-01T16:50:30Z")
Hello there, I´m trying to generate reports using pdf or png but for some reason is not showing on the share option from kibana discover tab. After checking on the reporting diagnostics tab, I saw something that may be… --- ## [Elasticsearch delete data for more than 2 mohts in multiple index](https://discuss.elastic.co/t/elasticsearch-delete-data-for-more-than-2-mohts-in-multiple-index/311144)
**Author:** [@navin1093](https://discuss.elastic.co/u/navin1093)\ **Replies:** 1\ **Last updated:** [August 1, 2022, 4:44pm UTC](https://discuss.elastic.co/t/elasticsearch-delete-data-for-more-than-2-mohts-in-multiple-index/311144 "2022-08-01T16:44:19Z")
Hi friends, I have 3 index. how can i delete data form these index if it is more than 2 months. I know can use ILM policy but my index is created from elastalert whereby i cant use ILM policy as it wont append timestamp… --- ## [Installing custom Elasticsearch plugins in Elastic Cloud](https://discuss.elastic.co/t/installing-custom-elasticsearch-plugins-in-elastic-cloud/311032)
**Author:** [@Simone\_Scarduzio](https://discuss.elastic.co/u/Simone_Scarduzio)\ **Replies:** 8\ **Last updated:** [August 1, 2022, 4:44pm UTC](https://discuss.elastic.co/t/installing-custom-elasticsearch-plugins-in-elastic-cloud/311032 "2022-08-01T16:44:14Z")
Hello, I'm a trial user of Elastic cloud, and I can see it's technically possible to install custom plugins in Elasticsearch nodes: However, as you can see, I'm not allowed to use this feature for my "subscription l… --- ## [Kibana - Upgrade Assistant](https://discuss.elastic.co/t/kibana-upgrade-assistant/311121)
**Author:** [@BenH1234](https://discuss.elastic.co/u/BenH1234)\ **Replies:** 3\ **Last updated:** [August 1, 2022, 4:11pm UTC](https://discuss.elastic.co/t/kibana-upgrade-assistant/311121 "2022-08-01T16:11:14Z")
Hi, I'm currently running an unsupported ES server version 5.6.16. I've recently upgraded it from 2 to 5 and I'm looking to upgrade it further. From 2 to 5 I used a migration plugin which isn't available in 5 so I'm look… --- ## [Metricbeat configuration multiples modules with different outputs](https://discuss.elastic.co/t/metricbeat-configuration-multiples-modules-with-different-outputs/311117)
**Author:** [@melzi](https://discuss.elastic.co/u/melzi)\ **Replies:** 1\ **Last updated:** [August 1, 2022, 3:22pm UTC](https://discuss.elastic.co/t/metricbeat-configuration-multiples-modules-with-different-outputs/311117 "2022-08-01T15:22:25Z")
Hello everyone, I have a problem with ELK and I would like to ask you for help... I have activated 2 modules metricbeat: System and Logstash-xpack. I need to send the data from the System module to logstash node and t… --- ## [Instrumentation settings available in Elastic agent?](https://discuss.elastic.co/t/instrumentation-settings-available-in-elastic-agent/311128)
**Author:** [@norgro2601](https://discuss.elastic.co/u/norgro2601)\ **Replies:** 0\ **Last updated:** [August 1, 2022, 2:09pm UTC](https://discuss.elastic.co/t/instrumentation-settings-available-in-elastic-agent/311128 "2022-08-01T14:09:54Z")
Hi, I want to upgrade some Beats to Elastic Agent, and in the Beats, the settings for instrumentation to show the Go agent in APM are available. Is there a way to have this with the Elastic agent as well and if, where c… --- ## [Logstash if condition regex not working](https://discuss.elastic.co/t/logstash-if-condition-regex-not-working/310737)
**Author:** [@Gosia96](https://discuss.elastic.co/u/Gosia96)\ **Replies:** 10\ **Last updated:** [August 1, 2022, 1:56pm UTC](https://discuss.elastic.co/t/logstash-if-condition-regex-not-working/310737 "2022-08-01T13:56:53Z")
Hi, I'm trying to use regex in the if condition in logstash. My goal is to send the output into 2 different indexes basing on what the field "tags" contains. So far I had no luck with it. Logstash simply ignores my co… --- ## [I want best matching result comes first with fuzziness: AUTO on](https://discuss.elastic.co/t/i-want-best-matching-result-comes-first-with-fuzziness-auto-on/311085)
**Author:** [@Rakhshunda\_Noorein\_J](https://discuss.elastic.co/u/Rakhshunda_Noorein_J)\ **Replies:** 2\ **Last updated:** [August 1, 2022, 1:33pm UTC](https://discuss.elastic.co/t/i-want-best-matching-result-comes-first-with-fuzziness-auto-on/311085 "2022-08-01T13:33:06Z")
{ "size":1000, "query":{ "multi\_match":{ "query":"monsoon", "type": "best\_fields", "fields":\["EntityType^4", "Title","Title.\_2gram","Title.\_3gram","Title.\_index\_pre… --- ## [Where is my data of fortinet?](https://discuss.elastic.co/t/where-is-my-data-of-fortinet/311009)
**Author:** [@morad\_della3](https://discuss.elastic.co/u/morad_della3)\ **Replies:** 27\ **Last updated:** [August 1, 2022, 1:20pm UTC](https://discuss.elastic.co/t/where-is-my-data-of-fortinet/311009 "2022-08-01T13:20:03Z")
Hello, I installed Elasticsearch and kibana and filebeat in ubuntu 22.04 VM and i installed FortiGate 7.2.0 in other VM in VMware workstation, I follow the steps to upload the Fortinet logs in elastic and kibana as the … --- ## [\_source filed is using to much disk space](https://discuss.elastic.co/t/source-filed-is-using-to-much-disk-space/311103)
**Author:** [@Maksym\_Postument](https://discuss.elastic.co/u/Maksym_Postument)\ **Replies:** 2\ **Last updated:** [August 1, 2022, 12:11pm UTC](https://discuss.elastic.co/t/source-filed-is-using-to-much-disk-space/311103 "2022-08-01T12:11:55Z")
\_source for metricbeat index is using a lot of space. Index size is 15.2gb and \_source filed is 12.2gb. And from 4 kubernetes nodes in one day total size of metricbeat size is 160 gb. Any ideas why metricbeat index size … --- ## [Grok Plugin: load custom patterns in Oniguruma format from file](https://discuss.elastic.co/t/grok-plugin-load-custom-patterns-in-oniguruma-format-from-file/311108)
**Author:** [@who](https://discuss.elastic.co/u/who)\ **Replies:** 0\ **Last updated:** [August 1, 2022, 11:52am UTC](https://discuss.elastic.co/t/grok-plugin-load-custom-patterns-in-oniguruma-format-from-file/311108 "2022-08-01T11:52:44Z")
According to the documentation, we can use Oniguruma regex pattern formats in grok plugin (i.e. (?\the pattern here)). Also, there's the patterns\_dir configuration option that instructs grok filter to load pa… --- ## [Display all python prints in logstash](https://discuss.elastic.co/t/display-all-python-prints-in-logstash/310351)
**Author:** [@Didi\_Sisi](https://discuss.elastic.co/u/Didi_Sisi)\ **Replies:** 1\ **Last updated:** [August 1, 2022, 11:39am UTC](https://discuss.elastic.co/t/display-all-python-prints-in-logstash/310351 "2022-08-01T11:39:30Z")
Hello, I have a python script like this: import time dictionary1 ={ "id": "02", "name": "sunil", "department": "HR" } dictionary2 ={ "id": "03", "name": "sunilals", "depa… --- ## [How can i use ELK 8.3.3 without security enabled?](https://discuss.elastic.co/t/how-can-i-use-elk-8-3-3-without-security-enabled/310501)
**Author:** [@theacodes](https://discuss.elastic.co/u/theacodes)\ **Replies:** 1\ **Last updated:** [August 1, 2022, 11:39am UTC](https://discuss.elastic.co/t/how-can-i-use-elk-8-3-3-without-security-enabled/310501 "2022-08-01T11:39:01Z")
Hi I installed ELK 8. x on my machine, a single node. also enabled xpack security as without doing this I cannot add any agents. cert I'm using is self-signed. Now when I install the agent in the local machine it sen… --- ## [Moving from filebeats 6.8 to 7.10](https://discuss.elastic.co/t/moving-from-filebeats-6-8-to-7-10/310851)
**Author:** [@Ryan5](https://discuss.elastic.co/u/Ryan5)\ **Replies:** 1\ **Last updated:** [August 1, 2022, 10:59am UTC](https://discuss.elastic.co/t/moving-from-filebeats-6-8-to-7-10/310851 "2022-08-01T10:59:02Z")
Hi, We are trying to move from filebeats version 6.8 to 7.10 however, the way to collect docker logs seems to have changed and following the new autodiscover method docker logs are not appearing in elasticsearch but nor… --- ## [Logstash Translate filter plugin based on multilevel dictionary](https://discuss.elastic.co/t/logstash-translate-filter-plugin-based-on-multilevel-dictionary/311105)
**Author:** [@who](https://discuss.elastic.co/u/who)\ **Replies:** 0\ **Last updated:** [August 1, 2022, 10:50am UTC](https://discuss.elastic.co/t/logstash-translate-filter-plugin-based-on-multilevel-dictionary/311105 "2022-08-01T10:50:01Z")
Assuming we have a dictionary with nested structure (YAML): "key1": "sub-key1": "value1" "sub-key2": "value2" "sub-key3": "value3" "key2": "sub-key4": "value4" "sub-key5": "value5" "sub-key6": "value6" Curr… --- ## [Reference to grok patterns that are in another field of event](https://discuss.elastic.co/t/reference-to-grok-patterns-that-are-in-another-field-of-event/311104)
**Author:** [@who](https://discuss.elastic.co/u/who)\ **Replies:** 0\ **Last updated:** [August 1, 2022, 10:46am UTC](https://discuss.elastic.co/t/reference-to-grok-patterns-that-are-in-another-field-of-event/311104 "2022-08-01T10:46:15Z")
There's a regexes array field in the event that contains some regexes: "regexes" =\> \[ \[0\] "regex1", \[1\] "regex2", \[2\] "regex3" \] As this field's content get filled dynamicall… --- ## [Beats on SUSE Linux Enterprise Server 11 (X86\_64)](https://discuss.elastic.co/t/beats-on-suse-linux-enterprise-server-11-x86-64/310885)
**Author:** [@aji.shinde7](https://discuss.elastic.co/u/aji.shinde7)\ **Replies:** 1\ **Last updated:** [August 1, 2022, 10:40am UTC](https://discuss.elastic.co/t/beats-on-suse-linux-enterprise-server-11-x86-64/310885 "2022-08-01T10:40:20Z")
Hello Experts, I was have installed Metricbeat and Filebeat Version 7.16.3 on SUSE Linux Enterprise Server 11 (X86\_64) but its not working. No data is flowing in Elasticsearch Index. I have copied same Metricbeat and F… --- ## [Beats to Logstash pipeline - Self signed cert implementation](https://discuss.elastic.co/t/beats-to-logstash-pipeline-self-signed-cert-implementation/311090)
**Author:** [@sravan\_kaheti](https://discuss.elastic.co/u/sravan_kaheti)\ **Replies:** 1\ **Last updated:** [August 1, 2022, 10:32am UTC](https://discuss.elastic.co/t/beats-to-logstash-pipeline-self-signed-cert-implementation/311090 "2022-08-01T10:32:45Z")
Hi There , I am using filebeat, metricbeat and passing output to my logstash pipeline (version 8.1). I have a requirement that need to implement self signed cert to secure communication between beats to our logstash. B… --- ## [Logstash Ruby concat & event](https://discuss.elastic.co/t/logstash-ruby-concat-event/308816)
**Author:** [@jsauvebois](https://discuss.elastic.co/u/jsauvebois)\ **Replies:** 3\ **Last updated:** [August 1, 2022, 9:42am UTC](https://discuss.elastic.co/t/logstash-ruby-concat-event/308816 "2022-08-01T09:42:24Z")
Hi, In a first time, I tested how to add a field via ruby code based on existing field duration and event ... ruby { code =\> " if event.get('duration').nil? event.set('duration\_time','') else duration\_time = ev… --- ## [Get exact complete phonetic match](https://discuss.elastic.co/t/get-exact-complete-phonetic-match/311095)
**Author:** [@mkoch1](https://discuss.elastic.co/u/mkoch1)\ **Replies:** 0\ **Last updated:** [August 1, 2022, 9:29am UTC](https://discuss.elastic.co/t/get-exact-complete-phonetic-match/311095 "2022-08-01T09:29:07Z")
I have a document with the field "familyname" with a phonetic analyzer. The content can be something like "von meier schmidt". Is there a possibility to only get a match, if I search for "von meyer schmidt" or "von meie… --- ## [Logstash: dynamic topic based on value of field](https://discuss.elastic.co/t/logstash-dynamic-topic-based-on-value-of-field/310976)
**Author:** [@jori-be](https://discuss.elastic.co/u/jori-be)\ **Replies:** 2\ **Last updated:** [August 1, 2022, 9:10am UTC](https://discuss.elastic.co/t/logstash-dynamic-topic-based-on-value-of-field/310976 "2022-08-01T09:10:27Z")
I'm trying to configure Logstash with Kafka output. Basically I want to put data in different Kafka topics based on a field. So in example below, I have a field name in the data. All documents should be posted to the to… --- ## [Filebeat sends logs with delay](https://discuss.elastic.co/t/filebeat-sends-logs-with-delay/311038)
**Author:** [@behzad\_alipoor](https://discuss.elastic.co/u/behzad_alipoor)\ **Replies:** 1\ **Last updated:** [August 1, 2022, 8:51am UTC](https://discuss.elastic.co/t/filebeat-sends-logs-with-delay/311038 "2022-08-01T08:51:00Z")
I send logs from filebeat to elasticsearch directly . the service that i use generates logs every second . most of the time it works properly but sometimes the logs reach to elastic after 15 minutes or later and I don'… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=843) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=845)