# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=892 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 893 --- ## [Winlogbeat still creates default index when setting up to use a custom index](https://discuss.elastic.co/t/winlogbeat-still-creates-default-index-when-setting-up-to-use-a-custom-index/307905)
**Author:** [@Ryan\_Clark](https://discuss.elastic.co/u/Ryan_Clark)\ **Replies:** 0\ **Last updated:** [June 22, 2022, 5:23pm UTC](https://discuss.elastic.co/t/winlogbeat-still-creates-default-index-when-setting-up-to-use-a-custom-index/307905 "2022-06-22T17:23:48Z")
I'm trying to have winlogbeat write to a custom index. I've pre-configured the template, lifecycle policy, and initial index with alias. Using the instructions here (without the date agent version) doesn't work. It ignor… --- ## [Data is not parsed correctly from Logstash to Elasticsearch](https://discuss.elastic.co/t/data-is-not-parsed-correctly-from-logstash-to-elasticsearch/307251)
**Author:** [@jh197](https://discuss.elastic.co/u/jh197)\ **Replies:** 1\ **Last updated:** [June 22, 2022, 4:37pm UTC](https://discuss.elastic.co/t/data-is-not-parsed-correctly-from-logstash-to-elasticsearch/307251 "2022-06-22T16:37:37Z")
Hello, hopefully someone can help me. The big problem is, that I can't see the data in Elasticsearch with Kibana, which I am inserting with Filebeat and Logstash. I think the main issue has to be between the Logstash an… --- ## [Another method or way to not close indexes during Restore](https://discuss.elastic.co/t/another-method-or-way-to-not-close-indexes-during-restore/307897)
**Author:** [@wonderland14](https://discuss.elastic.co/u/wonderland14)\ **Replies:** 1\ **Last updated:** [June 22, 2022, 4:21pm UTC](https://discuss.elastic.co/t/another-method-or-way-to-not-close-indexes-during-restore/307897 "2022-06-22T16:21:48Z")
Good day, ! Just want to ask for help/assistance to an issue during our testing from the Snapshot and Restore. During Restoration of the Snapshot, it keeps on asking us to close or delete the index because it has the sa… --- ## [How to secure elasticsearch on kubernetes](https://discuss.elastic.co/t/how-to-secure-elasticsearch-on-kubernetes/306570)
**Author:** [@jessewhite](https://discuss.elastic.co/u/jessewhite)\ **Replies:** 3\ **Last updated:** [June 22, 2022, 4:09pm UTC](https://discuss.elastic.co/t/how-to-secure-elasticsearch-on-kubernetes/306570 "2022-06-22T16:09:20Z")
Hello, i have ELK deployed on a k8s cluster with helm charts. i wanted to add security to Elasticsearch so i can add users and control the access. but since i'm new to ELK i didn't know how or i found a good solution fo… --- ## [Snapshot and Restore](https://discuss.elastic.co/t/snapshot-and-restore/306938)
**Author:** [@wonderland14](https://discuss.elastic.co/u/wonderland14)\ **Replies:** 4\ **Last updated:** [June 22, 2022, 3:44pm UTC](https://discuss.elastic.co/t/snapshot-and-restore/306938 "2022-06-22T15:44:10Z")
Hello Everyone, I have a few questions that get me confused while doing Snapshot and Restore. I keep on searching it on the internet but I don't get any sense from it, its not helping me. For those who experienced kindly… --- ## [Full Text Search with JAVA!](https://discuss.elastic.co/t/full-text-search-with-java/307887)
**Author:** [@Serkan\_Demir](https://discuss.elastic.co/u/Serkan_Demir)\ **Replies:** 2\ **Last updated:** [June 22, 2022, 2:51pm UTC](https://discuss.elastic.co/t/full-text-search-with-java/307887 "2022-06-22T14:51:48Z")
We have a project and we use ElasticSearch and Java. I improved myself and I can Aggregations, Delete, Update , Insert , Empty index creating, wildcard and mapping etc. from JAVA . But only problem is in our project we g… --- ## [ERROR metrics/metrics.go:376 error getting cgroup stats: error fetching stats for controller io: error fetching IO stats: error fetching io.pressure for path /sys/fs/cgroup:: open /sys/fs/cgroup/io.pressure: no such file or directory](https://discuss.elastic.co/t/error-metrics-metrics-go-376-error-getting-cgroup-stats-error-fetching-stats-for-controller-io-error-fetching-io-stats-error-fetching-io-pressure-for-path-sys-fs-cgroup-open-sys-fs-cgroup-io-pressure-no-such-file-or-directory/307804)
**Author:** [@alexus](https://discuss.elastic.co/u/alexus)\ **Replies:** 2\ **Last updated:** [June 22, 2022, 2:51pm UTC](https://discuss.elastic.co/t/error-metrics-metrics-go-376-error-getting-cgroup-stats-error-fetching-stats-for-controller-io-error-fetching-io-stats-error-fetching-io-pressure-for-path-sys-fs-cgroup-open-sys-fs-cgroup-io-pressure-no-such-file-or-directory/307804 "2022-06-22T14:51:21Z")
Hello World! I'm following Run Filebeat on Docker | Filebeat Reference \[7.17\] | Elastic, yet seeing following ERROR in my logs (over and over): filebeat | 2022-06-21T21:08:17.932Z ERROR metrics/metrics.go:376 er… --- ## [Getting BulkIndexError When Trying to Write Documents to ElasticsearchDocumentStore()](https://discuss.elastic.co/t/getting-bulkindexerror-when-trying-to-write-documents-to-elasticsearchdocumentstore/307894)
**Author:** [@Marsa\_Andari](https://discuss.elastic.co/u/Marsa_Andari)\ **Replies:** 0\ **Last updated:** [June 22, 2022, 2:51pm UTC](https://discuss.elastic.co/t/getting-bulkindexerror-when-trying-to-write-documents-to-elasticsearchdocumentstore/307894 "2022-06-22T14:51:03Z")
My goal is to write documents that I have from a csv file (around 700MB) but I received a BulkIndexError Here is my code: from haystack.document\_stores.elasticsearch import ElasticsearchDocumentStore document\_store = E… --- ## [Missing Fleet Default server policy](https://discuss.elastic.co/t/missing-fleet-default-server-policy/307874)
**Author:** [@ghostmomo](https://discuss.elastic.co/u/ghostmomo)\ **Replies:** 0\ **Last updated:** [June 22, 2022, 12:15pm UTC](https://discuss.elastic.co/t/missing-fleet-default-server-policy/307874 "2022-06-22T12:15:07Z")
Elastic version: 8.2.2 Kibana version: 8.2.2 OS: Windows server 2019 on Azure I am trying to setup the fleet server but encounter some issue while setting it up. After I generated the service token and attempted to u… --- ## [New Install - Security Error](https://discuss.elastic.co/t/new-install-security-error/307549)
**Author:** [@jhop](https://discuss.elastic.co/u/jhop)\ **Replies:** 5\ **Last updated:** [June 22, 2022, 2:11pm UTC](https://discuss.elastic.co/t/new-install-security-error/307549 "2022-06-22T14:11:09Z")
Hi I am new to Elastic. I have just installed Elasticsearch and Kibana. I am able to hit Elasticsearch on my browser. I configured it with basic security. I am now trying to connect with Kibana and I get "Kibana server i… --- ## [Alert when data is missing?](https://discuss.elastic.co/t/alert-when-data-is-missing/307886)
**Author:** [@LionsELK](https://discuss.elastic.co/u/LionsELK)\ **Replies:** 3\ **Last updated:** [June 22, 2022, 2:07pm UTC](https://discuss.elastic.co/t/alert-when-data-is-missing/307886 "2022-06-22T14:07:13Z")
Hi all, Is there some form of functionality built into the ELK stack that can automatically alert me when data is missing? i.e. if we're missing a chunk of time like the image below. Currently, we're only made aware… --- ## [Logstash tcp input CPU perfomance](https://discuss.elastic.co/t/logstash-tcp-input-cpu-perfomance/307759)
**Author:** [@perezdev](https://discuss.elastic.co/u/perezdev)\ **Replies:** 9\ **Last updated:** [June 22, 2022, 1:49pm UTC](https://discuss.elastic.co/t/logstash-tcp-input-cpu-perfomance/307759 "2022-06-22T13:49:26Z")
Hello, I have configured logstash using one tcp input as follows: input { #logs01 tcp { type =\> "logs" codec =\> "line" port =\> 9916 add\_field =\> { "event\_dataset" =\> "logs\_01" } } } With this co… --- ## [How to identify and remove duplicates in Elasticsearch index](https://discuss.elastic.co/t/how-to-identify-and-remove-duplicates-in-elasticsearch-index/307866)
**Author:** [@Sowmya1](https://discuss.elastic.co/u/Sowmya1)\ **Replies:** 3\ **Last updated:** [June 22, 2022, 1:35pm UTC](https://discuss.elastic.co/t/how-to-identify-and-remove-duplicates-in-elasticsearch-index/307866 "2022-06-22T13:35:56Z")
we are using elasticsearch 7.11.1 recently we observed an issue and below are the points for it. we store data for every 15 mins interval and we get time stamp from our input file (ex: 05:00, 23:15, 20:30, 11:45 ) rece… --- ## [Kibana 7.16.3 installing/using jsPDF for custom plugins](https://discuss.elastic.co/t/kibana-7-16-3-installing-using-jspdf-for-custom-plugins/306725)
**Author:** [@ssimmons](https://discuss.elastic.co/u/ssimmons)\ **Replies:** 1\ **Last updated:** [June 22, 2022, 12:56pm UTC](https://discuss.elastic.co/t/kibana-7-16-3-installing-using-jspdf-for-custom-plugins/306725 "2022-06-22T12:56:39Z")
We are in the process of converting our Kibana 7.10.2 custom plugins into Kibana 7.16.3 custom plugins. We use the jsPDF module for creating pdfs of our dashboards for downloading. We are having issues using jsPDF in Kib… --- ## [Change error message in Kibana widgets](https://discuss.elastic.co/t/change-error-message-in-kibana-widgets/307848)
**Author:** [@Avarjana](https://discuss.elastic.co/u/Avarjana)\ **Replies:** 3\ **Last updated:** [June 22, 2022, 12:45pm UTC](https://discuss.elastic.co/t/change-error-message-in-kibana-widgets/307848 "2022-06-22T12:45:16Z")
Is there a way to change these error messages to something like "No results found"? --- ## [Nested aggregation in Kibana Dashboard](https://discuss.elastic.co/t/nested-aggregation-in-kibana-dashboard/307871)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 3\ **Last updated:** [June 22, 2022, 12:30pm UTC](https://discuss.elastic.co/t/nested-aggregation-in-kibana-dashboard/307871 "2022-06-22T12:30:04Z")
Hi all, Let's say there is Fruits database Based on terms aggregation we have count of Oranges - 5 & Pears -3 & Apples - 3. Now 2 fruit categories (Pears & Apples ) have 3 as count. So here I have nested aggregation o… --- ## [ElasticSearch as primary DB for document library](https://discuss.elastic.co/t/elasticsearch-as-primary-db-for-document-library/307852)
**Author:** [@Gresmir](https://discuss.elastic.co/u/Gresmir)\ **Replies:** 2\ **Last updated:** [June 22, 2022, 12:05pm UTC](https://discuss.elastic.co/t/elasticsearch-as-primary-db-for-document-library/307852 "2022-06-22T12:05:47Z")
My task is a full-text search system for a really large amount of documents (tens of millions). Now I have documents as RTF file and their metadata, so all this will be indexed in Elasticsearch. These documents are uncha… --- ## [The CPU load increases, the CPU utilization decreases, and the Version Map continues to decrease for 30 hours](https://discuss.elastic.co/t/the-cpu-load-increases-the-cpu-utilization-decreases-and-the-version-map-continues-to-decrease-for-30-hours/307618)
**Author:** [@yanha186036](https://discuss.elastic.co/u/yanha186036)\ **Replies:** 1\ **Last updated:** [June 22, 2022, 12:03pm UTC](https://discuss.elastic.co/t/the-cpu-load-increases-the-cpu-utilization-decreases-and-the-version-map-continues-to-decrease-for-30-hours/307618 "2022-06-22T12:03:57Z")
question1：Why are indicators suddenly like this？ java code ex：Exception message failed to refresh index: user\_rank\_total question2：Why is the sharding uneven? node3 is not sharded --- ## [Increase row count in search table in kibana dashboard](https://discuss.elastic.co/t/increase-row-count-in-search-table-in-kibana-dashboard/307864)
**Author:** [@mangeshs](https://discuss.elastic.co/u/mangeshs)\ **Replies:** 3\ **Last updated:** [June 22, 2022, 12:02pm UTC](https://discuss.elastic.co/t/increase-row-count-in-search-table-in-kibana-dashboard/307864 "2022-06-22T12:02:16Z")
I have added discover search results in dashboard and changed row count limit to 500 default but it is not reflecting to search table. Row count in search table is limited to 50. How to increase that. --- ## [Return multiple parent documents for each nested object match](https://discuss.elastic.co/t/return-multiple-parent-documents-for-each-nested-object-match/307873)
**Author:** [@dgurusam](https://discuss.elastic.co/u/dgurusam)\ **Replies:** 0\ **Last updated:** [June 22, 2022, 11:59am UTC](https://discuss.elastic.co/t/return-multiple-parent-documents-for-each-nested-object-match/307873 "2022-06-22T11:59:52Z")
Hi All, I have an index which contains a nested object. I would like to return multiple parent documents for each object matched in the nested object. For example: Index Details: "settings": { "number\_of\_sha… --- ## [Filebeat made my disk full in less than one day](https://discuss.elastic.co/t/filebeat-made-my-disk-full-in-less-than-one-day/307856)
**Author:** [@Khalifa\_Khalifi](https://discuss.elastic.co/u/Khalifa_Khalifi)\ **Replies:** 1\ **Last updated:** [June 22, 2022, 11:58am UTC](https://discuss.elastic.co/t/filebeat-made-my-disk-full-in-less-than-one-day/307856 "2022-06-22T11:58:21Z")
Using filebeat made my disk full in less than one day!!! Is there any config I could apply to filebeat.yml to avoid this please? Using this tool is really dangerous. Prod servers are suddenly full for no reason. --- ## [How to make a table like Excel sheet with Kibana?](https://discuss.elastic.co/t/how-to-make-a-table-like-excel-sheet-with-kibana/25687)
**Author:** [@cherah30](https://discuss.elastic.co/u/cherah30)\ **Replies:** 18\ **Last updated:** [June 22, 2022, 11:47am UTC](https://discuss.elastic.co/t/how-to-make-a-table-like-excel-sheet-with-kibana/25687 "2022-06-22T11:47:44Z")
I apologize for my beginner question. starting from "Discover" part of kibana, I could select some fields, filtering, ...etc, then I recorded the resultat of my research. Now, I would like to show the result of my se… --- ## [Elasticsearch SQL query with date and timestamp](https://discuss.elastic.co/t/elasticsearch-sql-query-with-date-and-timestamp/307753)
**Author:** [@Pranjal\_Sett](https://discuss.elastic.co/u/Pranjal_Sett)\ **Replies:** 3\ **Last updated:** [June 22, 2022, 11:47am UTC](https://discuss.elastic.co/t/elasticsearch-sql-query-with-date-and-timestamp/307753 "2022-06-22T11:47:26Z")
Hi, As per specification I want to get the data as per logic given. Here is the logic below: sum(QUANTITY) where FILE\_CREATION\_DATE = TODAY() and INDEX\_NUMBER in (2, 4) and SUBINVENTORY = \[x,y,z\] I have transferred t… --- ## [Filebeat system pipeline setup fails](https://discuss.elastic.co/t/filebeat-system-pipeline-setup-fails/307872)
**Author:** [@dmgeurts](https://discuss.elastic.co/u/dmgeurts)\ **Replies:** 0\ **Last updated:** [June 22, 2022, 11:30am UTC](https://discuss.elastic.co/t/filebeat-system-pipeline-setup-fails/307872 "2022-06-22T11:30:18Z")
I've enabled the system module, enabled syslog and auth in system.yml. Yet for some reason I still get this error: $ sudo filebeat setup --pipelines --modules system Exiting: module system is configured but has no enabl… --- ## [Conditionally Apply Attachment Processor](https://discuss.elastic.co/t/conditionally-apply-attachment-processor/307867)
**Author:** [@jasmoon](https://discuss.elastic.co/u/jasmoon)\ **Replies:** 0\ **Last updated:** [June 22, 2022, 10:43am UTC](https://discuss.elastic.co/t/conditionally-apply-attachment-processor/307867 "2022-06-22T10:43:39Z")
Hi all, first time posting in this forum. I have trouble writing the condition to apply the attachment processor. Below is the wrong configuration of the pipeline: PUT \_ingest/pipeline/attachment { "description" : "Ex… --- ## [@elastic/elasticsearch](https://discuss.elastic.co/t/elastic-elasticsearch/307829)
**Author:** [@Rajan\_Devkota](https://discuss.elastic.co/u/Rajan_Devkota)\ **Replies:** 2\ **Last updated:** [June 22, 2022, 10:16am UTC](https://discuss.elastic.co/t/elastic-elasticsearch/307829 "2022-06-22T10:16:30Z")
Hello everyone. I am using elasticsearch client(@elastic/elasticsearch) version 7.13.0 and my elasticsearch server version is 7.10.0. And I am using typescript and node js in my backend. While using the elasticsearch c… --- ## [Filebeat writting on 2 different indices](https://discuss.elastic.co/t/filebeat-writting-on-2-different-indices/307859)
**Author:** [@Elie\_Sbat](https://discuss.elastic.co/u/Elie_Sbat)\ **Replies:** 0\ **Last updated:** [June 22, 2022, 9:49am UTC](https://discuss.elastic.co/t/filebeat-writting-on-2-different-indices/307859 "2022-06-22T09:49:00Z")
Hello, I am ELK cluster v8 with filebeat v8.1.0 ot ship application logs. I have 2 different indices one for proxy and the other for owa. The name of the indices are: filebeat-8.1.0 for proxy logs filebeat-8.1.0-owa… --- ## [Snapshots on datastream](https://discuss.elastic.co/t/snapshots-on-datastream/306779)
**Author:** [@Bilanda](https://discuss.elastic.co/u/Bilanda)\ **Replies:** 2\ **Last updated:** [June 22, 2022, 9:46am UTC](https://discuss.elastic.co/t/snapshots-on-datastream/306779 "2022-06-22T09:46:48Z")
Hello, I recently decided to moove from traditionals index to datastream. Everything goes fine, template and ILM are working fine, my backing index (.ds-logs......) are daily rotated. I've just got two issues with dat… --- ## [How to identify and remove duplicates in Elasticsearch index](https://discuss.elastic.co/t/how-to-identify-and-remove-duplicates-in-elasticsearch-index/307842)
**Author:** [@Komal\_42](https://discuss.elastic.co/u/Komal_42)\ **Replies:** 2\ **Last updated:** [June 22, 2022, 9:38am UTC](https://discuss.elastic.co/t/how-to-identify-and-remove-duplicates-in-elasticsearch-index/307842 "2022-06-22T09:38:51Z")
we are using elasticsearch 7.11.1 recently we observed an issue and below are the points for it. we store data for every 15 mins interval and we get time stamp from our input file (ex: 05:00, 23:15, 20:30, 11:45 ) rece… --- ## [Llegal\_argument\_exception: index.lifecycle.rollover\_alias \[syslog\] does not point to index \[syslog-2022-06-22\]](https://discuss.elastic.co/t/llegal-argument-exception-index-lifecycle-rollover-alias-syslog-does-not-point-to-index-syslog-2022-06-22/307857)
**Author:** [@Lucy\_S](https://discuss.elastic.co/u/Lucy_S)\ **Replies:** 0\ **Last updated:** [June 22, 2022, 9:24am UTC](https://discuss.elastic.co/t/llegal-argument-exception-index-lifecycle-rollover-alias-syslog-does-not-point-to-index-syslog-2022-06-22/307857 "2022-06-22T09:24:34Z")
Hi all, i got this message on all index llegal\_argument\_exception: index.lifecycle.rollover\_alias \[syslog\] does not point to index \[syslog-2022-06-22\] configs: curl -X POST "localhost:5601/api/index\_patterns/index\_… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=891) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=893)