# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=915 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 916 --- ## [Where can I access the logs sent to Elasticsearch?](https://discuss.elastic.co/t/where-can-i-access-the-logs-sent-to-elasticsearch/306259)
**Author:** [@BenGur](https://discuss.elastic.co/u/BenGur)\ **Replies:** 3\ **Last updated:** [June 3, 2022, 6:35pm UTC](https://discuss.elastic.co/t/where-can-i-access-the-logs-sent-to-elasticsearch/306259 "2022-06-03T18:35:00Z")
Hello, I am trying to access the log files sent to Elasticsearch outside of the Kibana browser but don't know where to find them. I am running Elasticsearch on a remote CentOS 7 server with another AWS CentOS 7 server … --- ## [Out of the Box ML jobs for Security](https://discuss.elastic.co/t/out-of-the-box-ml-jobs-for-security/305162)
**Author:** [@alaine](https://discuss.elastic.co/u/alaine)\ **Replies:** 3\ **Last updated:** [June 3, 2022, 3:41pm UTC](https://discuss.elastic.co/t/out-of-the-box-ml-jobs-for-security/305162 "2022-06-03T15:41:42Z")
Good Morning, I am looking for help/advice in regards to using the out of the box ML jobs. Specifically, some of the jobs that are underlying SIEM detections. I have an environment with 4500 hosts sending endpoint data … --- ## [Diagram gantt](https://discuss.elastic.co/t/diagram-gantt/306316)
**Author:** [@meyer1](https://discuss.elastic.co/u/meyer1)\ **Replies:** 1\ **Last updated:** [June 3, 2022, 3:02pm UTC](https://discuss.elastic.co/t/diagram-gantt/306316 "2022-06-03T15:02:57Z")
Hello everyone, I need help to make a gantt chart. I have in my data the date of my appointments and the duration of each one. How is it possible to make a gantt chart from this? Thank you in advance for your help --- ## [Formula to show percentage on gauge showing wrong values](https://discuss.elastic.co/t/formula-to-show-percentage-on-gauge-showing-wrong-values/306283)
**Author:** [@akshay\_bhardwaj](https://discuss.elastic.co/u/akshay_bhardwaj)\ **Replies:** 2\ **Last updated:** [June 3, 2022, 3:01pm UTC](https://discuss.elastic.co/t/formula-to-show-percentage-on-gauge-showing-wrong-values/306283 "2022-06-03T15:01:43Z")
Formula to show percentage or division on gauge showing wrong values I have used below advanced json formula but its showing zero. Please help and let me know the correct method to find percentage . I need (sum of … --- ## [Rally 7.9.2 is not supported?](https://discuss.elastic.co/t/rally-7-9-2-is-not-supported/306331)
**Author:** [@Gsqsf](https://discuss.elastic.co/u/Gsqsf)\ **Replies:** 9\ **Last updated:** [June 3, 2022, 2:40pm UTC](https://discuss.elastic.co/t/rally-7-9-2-is-not-supported/306331 "2022-06-03T14:40:13Z")
Elasticsearch.exceptions.UnsupportedProductError: The client noticed that the server is not a supported distribution of Elasticsearch The Elasticsearch server version is 7.9.2. Tagline is "You Know, for Search" build\_… --- ## [Looking to get only the latest records from the index](https://discuss.elastic.co/t/looking-to-get-only-the-latest-records-from-the-index/306205)
**Author:** [@Mohamed\_Naufal](https://discuss.elastic.co/u/Mohamed_Naufal)\ **Replies:** 7\ **Last updated:** [June 3, 2022, 2:02pm UTC](https://discuss.elastic.co/t/looking-to-get-only-the-latest-records-from-the-index/306205 "2022-06-03T14:02:17Z")
Hi Community, I'm currently working on Elasticsearch and looking for an option to retrieve only the latest records from the index. Let me break down this query, We're using AWS Data Stream to load the logs and then, i… --- ## [Kibana Canvas disable link based on value](https://discuss.elastic.co/t/kibana-canvas-disable-link-based-on-value/303926)
**Author:** [@Bigbad](https://discuss.elastic.co/u/Bigbad)\ **Replies:** 2\ **Last updated:** [June 3, 2022, 1:25pm UTC](https://discuss.elastic.co/t/kibana-canvas-disable-link-based-on-value/303926 "2022-06-03T13:25:33Z")
Hello, Is it possible to disable a link of canvas Text Element based on search value ? For example if value=1, link is supposed to be not clickable. Thank You --- ## [Filebeat service is not starting in debian docker image](https://discuss.elastic.co/t/filebeat-service-is-not-starting-in-debian-docker-image/306340)
**Author:** [@Kumar\_Nikhil](https://discuss.elastic.co/u/Kumar_Nikhil)\ **Replies:** 0\ **Last updated:** [June 3, 2022, 1:08pm UTC](https://discuss.elastic.co/t/filebeat-service-is-not-starting-in-debian-docker-image/306340 "2022-06-03T13:08:07Z")
We are trying to install filebeat in debian docker image. NAME="Debian GNU/Linux" VERSION\_ID="9" VERSION="9 (stretch)" ID=debian HOME\_URL=" Its successfully building the image. But when we run the image and check f… --- ## [Lucene (Or KQL) query to filter current day of week](https://discuss.elastic.co/t/lucene-or-kql-query-to-filter-current-day-of-week/306339)
**Author:** [@vincent2mots](https://discuss.elastic.co/u/vincent2mots)\ **Replies:** 0\ **Last updated:** [June 3, 2022, 1:06pm UTC](https://discuss.elastic.co/t/lucene-or-kql-query-to-filter-current-day-of-week/306339 "2022-06-03T13:06:38Z")
Hi there! I have some data on Elasticsearch with a datetime field. I would like to filter all the data where the dayofweek is the same as today's... this way, I would be able to get all friday's data, saturday's data, … --- ## [Elastic search restore](https://discuss.elastic.co/t/elastic-search-restore/306329)
**Author:** [@A\_j\_xx](https://discuss.elastic.co/u/A_j_xx)\ **Replies:** 4\ **Last updated:** [June 3, 2022, 1:00pm UTC](https://discuss.elastic.co/t/elastic-search-restore/306329 "2022-06-03T13:00:59Z")
Hi , I am new at Elasticsearch and have some doubts regarding restore , as the documentation is not very thorough on these points . Let us say i make some changes every time to my index and take a snapshot , now the n… --- ## [Aletring based on anomaly duration](https://discuss.elastic.co/t/aletring-based-on-anomaly-duration/305300)
**Author:** [@AmS](https://discuss.elastic.co/u/AmS)\ **Replies:** 5\ **Last updated:** [June 3, 2022, 12:55pm UTC](https://discuss.elastic.co/t/aletring-based-on-anomaly-duration/305300 "2022-06-03T12:55:31Z")
Hello, I m using Kibana machine Learning for anomaly detection. Also using « watcher » for sending email when anomaly has been detceted by the ML. I don’t want to send an email for each anomaly but just for continuous… --- ## [Parse Array and Send to Elastic Filter](https://discuss.elastic.co/t/parse-array-and-send-to-elastic-filter/306271)
**Author:** [@JeremyP](https://discuss.elastic.co/u/JeremyP)\ **Replies:** 2\ **Last updated:** [June 3, 2022, 12:54pm UTC](https://discuss.elastic.co/t/parse-array-and-send-to-elastic-filter/306271 "2022-06-03T12:54:23Z")
Hello, I have an array of strings which I'd like to send nested object to an Elasticsearch filter to obtain additional data in a separately stored index. I've been searching for an approach to this but I cannot seem to … --- ## [Filebeat harvest logs from encyrpted file](https://discuss.elastic.co/t/filebeat-harvest-logs-from-encyrpted-file/306025)
**Author:** [@florinsfetea](https://discuss.elastic.co/u/florinsfetea)\ **Replies:** 2\ **Last updated:** [June 3, 2022, 12:53pm UTC](https://discuss.elastic.co/t/filebeat-harvest-logs-from-encyrpted-file/306025 "2022-06-03T12:53:39Z")
Hello people, how would one go about collecting logs from an encrypted log file that has to be first decrypted I have some /var/log/my\_encrypted\_log.log to read this I have to pipe the contents to an binary that decry… --- ## [Can Auditbeat file integrity module detect unmount and mount of CIFS filesystem](https://discuss.elastic.co/t/can-auditbeat-file-integrity-module-detect-unmount-and-mount-of-cifs-filesystem/306336)
**Author:** [@fgjensen](https://discuss.elastic.co/u/fgjensen)\ **Replies:** 0\ **Last updated:** [June 3, 2022, 12:52pm UTC](https://discuss.elastic.co/t/can-auditbeat-file-integrity-module-detect-unmount-and-mount-of-cifs-filesystem/306336 "2022-06-03T12:52:23Z")
Hi Community, Can I use the Auditbeat file integrity module to detect if a share (Windows and CIFS) is mounted and unmounted? Any risc of Auditbeat to block unmounting the share? Best regards Flemming --- ## [EQL For Visualizations or Lens](https://discuss.elastic.co/t/eql-for-visualizations-or-lens/306326)
**Author:** [@Silver137](https://discuss.elastic.co/u/Silver137)\ **Replies:** 1\ **Last updated:** [June 3, 2022, 12:41pm UTC](https://discuss.elastic.co/t/eql-for-visualizations-or-lens/306326 "2022-06-03T12:41:22Z")
¿It's posible to use EQL querys to draw Visualizations on Kibana, similarely Lens or other Visualizations do? --- ## [Hardware requirement for my server ELK](https://discuss.elastic.co/t/hardware-requirement-for-my-server-elk/306229)
**Author:** [@Big\_Mara](https://discuss.elastic.co/u/Big_Mara)\ **Replies:** 4\ **Last updated:** [June 3, 2022, 12:05pm UTC](https://discuss.elastic.co/t/hardware-requirement-for-my-server-elk/306229 "2022-06-03T12:05:26Z")
Hi I am new in ELK and I wonder with what can I start if I have many firewalls and I get 200gb of logs per day. The deal is ELK is already installed but the server capacity is not enough so we need to resize it and upgr… --- ## [How to make nodes forget about the old/previous cluster?](https://discuss.elastic.co/t/how-to-make-nodes-forget-about-the-old-previous-cluster/306315)
**Author:** [@AS11](https://discuss.elastic.co/u/AS11)\ **Replies:** 3\ **Last updated:** [June 3, 2022, 12:04pm UTC](https://discuss.elastic.co/t/how-to-make-nodes-forget-about-the-old-previous-cluster/306315 "2022-06-03T12:04:49Z")
I had (and still have) a running 3-node cluster C1. C1 has all 3 nodes (es0,es1,es2) as master nodes. Then, accessible within the same network, I wanted to set up a second cluster C2 (nodes es3,es4,es5), to which I would… --- ## [Need daily data report](https://discuss.elastic.co/t/need-daily-data-report/305913)
**Author:** [@Poojan](https://discuss.elastic.co/u/Poojan)\ **Replies:** 4\ **Last updated:** [June 3, 2022, 11:30am UTC](https://discuss.elastic.co/t/need-daily-data-report/305913 "2022-06-03T11:30:57Z")
Hello guys, I have one question related to kibana alert feature. I want to send daily mail which includes excel sheet shows how much data we are getting daily in Elasticsearch index? is it possible without using any sc… --- ## [ML - Anomaly Detection - Weight Rare against Entity AND Population](https://discuss.elastic.co/t/ml-anomaly-detection-weight-rare-against-entity-and-population/306273)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 1\ **Last updated:** [June 3, 2022, 11:08am UTC](https://discuss.elastic.co/t/ml-anomaly-detection-weight-rare-against-entity-and-population/306273 "2022-06-03T11:08:21Z")
Hi All, I'm attempting to find a way to find anomalies within some data, but I'm having some trouble understanding the correct way to go about it. I want to effectively determine the weight of an anomaly by comparing t… --- ## [Vietnamese support](https://discuss.elastic.co/t/vietnamese-support/305037)
**Author:** [@Jean-Marc\_Autexier](https://discuss.elastic.co/u/Jean-Marc_Autexier)\ **Replies:** 2\ **Last updated:** [June 3, 2022, 10:50am UTC](https://discuss.elastic.co/t/vietnamese-support/305037 "2022-06-03T10:50:49Z")
Hi, the documentation \[1\] does mention the Vietnamese analysis plugin: I already do use the ICU plugin \[2\] for multi language support. How much better is the Vietnamese Plugin compared to ICU for Vietnamese language? … --- ## [Elastic agent indices - ILM Policy Changes](https://discuss.elastic.co/t/elastic-agent-indices-ilm-policy-changes/306320)
**Author:** [@praveen\_raju](https://discuss.elastic.co/u/praveen_raju)\ **Replies:** 0\ **Last updated:** [June 3, 2022, 10:03am UTC](https://discuss.elastic.co/t/elastic-agent-indices-ilm-policy-changes/306320 "2022-06-03T10:03:20Z")
Hello, We have deployed Elastic Agent on 1000+ VM's, i see default ILM policy is being used "metrics" for all the indices created by the elastic agent. Questions: Can we change the settings directly on the ILM polic… --- ## [Kibana Email Alert](https://discuss.elastic.co/t/kibana-email-alert/303013)
**Author:** [@\_Thomas](https://discuss.elastic.co/u/_Thomas)\ **Replies:** 7\ **Last updated:** [June 3, 2022, 9:42am UTC](https://discuss.elastic.co/t/kibana-email-alert/303013 "2022-06-03T09:42:48Z")
Hi Guys, I hope someone can shed some light on a strange thing. Long story short: I would like to receive Email-alerts whenever a certain Event-ID has been triggered. In my case Event ID: 4672 (with this information pa… --- ## [Taxonmy in ES 7.10 using search-time analyzer](https://discuss.elastic.co/t/taxonmy-in-es-7-10-using-search-time-analyzer/306312)
**Author:** [@wardyard](https://discuss.elastic.co/u/wardyard)\ **Replies:** 0\ **Last updated:** [June 3, 2022, 9:31am UTC](https://discuss.elastic.co/t/taxonmy-in-es-7-10-using-search-time-analyzer/306312 "2022-06-03T09:31:32Z")
Hi all! Since I've been struggling with this for quite a while now, I decided to try my luck here :wink: I'm working on a taxonomy search using managed vocabularies, as described in this article: Patterns for Elasticse… --- ## [Grok pattern construction](https://discuss.elastic.co/t/grok-pattern-construction/305850)
**Author:** [@anushka1203](https://discuss.elastic.co/u/anushka1203)\ **Replies:** 6\ **Last updated:** [June 3, 2022, 9:09am UTC](https://discuss.elastic.co/t/grok-pattern-construction/305850 "2022-06-03T09:09:02Z")
Hi, i need help in constructing the grok pattern for the following logs. had asked the same question earlier here- this pattern %{HTTPDERROR\_DATE:date}\\s:\\s%{LOGLEVEL:log}:%{GREEDYDATA:message} works for the following… --- ## [Licence Upgrade: From Gold to Platinum](https://discuss.elastic.co/t/licence-upgrade-from-gold-to-platinum/306183)
**Author:** [@smm](https://discuss.elastic.co/u/smm)\ **Replies:** 3\ **Last updated:** [June 3, 2022, 8:47am UTC](https://discuss.elastic.co/t/licence-upgrade-from-gold-to-platinum/306183 "2022-06-03T08:47:54Z")
Hi there, are there any issues to be excted while upgrading out licence from gold to platinum? Thanks and kind regards! --- ## [Unassigned shards after upgrade to 8.2](https://discuss.elastic.co/t/unassigned-shards-after-upgrade-to-8-2/304717)
**Author:** [@Ian\_Simpson](https://discuss.elastic.co/u/Ian_Simpson)\ **Replies:** 6\ **Last updated:** [June 3, 2022, 8:09am UTC](https://discuss.elastic.co/t/unassigned-shards-after-upgrade-to-8-2/304717 "2022-06-03T08:09:45Z")
I am managing an Elasticsearch cluster deployed to our Azure environment. I am trying to upgrade our test single-node cluster from 7.x to 8.2. I have done the following: Upgraded to 7.17.3 and confirmed all shards were… --- ## [Store max value of a metric in a week in elasticsearch](https://discuss.elastic.co/t/store-max-value-of-a-metric-in-a-week-in-elasticsearch/306209)
**Author:** [@S-elk](https://discuss.elastic.co/u/S-elk)\ **Replies:** 2\ **Last updated:** [June 3, 2022, 7:36am UTC](https://discuss.elastic.co/t/store-max-value-of-a-metric-in-a-week-in-elasticsearch/306209 "2022-06-03T07:36:41Z")
Hello! I am currently collecting the metrics of certain services and I am interested in storing the maximum value of a week. I know how to do it with the tsvb visualization but I don't know how to store it in the elasti… --- ## [Disable Replicate Data on Elasticsearch Cluster](https://discuss.elastic.co/t/disable-replicate-data-on-elasticsearch-cluster/306202)
**Author:** [@Xenial](https://discuss.elastic.co/u/Xenial)\ **Replies:** 4\ **Last updated:** [June 3, 2022, 7:34am UTC](https://discuss.elastic.co/t/disable-replicate-data-on-elasticsearch-cluster/306202 "2022-06-03T07:34:20Z")
Hello Elastic Team, I've create Elasticsearch with 3 node, when i send the data, Elasticsearch replicate my original data and consume more storage. How to disable replicated data on Elasticsearch Cluster? Thankyou --- ## [Migrate Elasticsearch Data](https://discuss.elastic.co/t/migrate-elasticsearch-data/306291)
**Author:** [@Xenial](https://discuss.elastic.co/u/Xenial)\ **Replies:** 1\ **Last updated:** [June 3, 2022, 7:04am UTC](https://discuss.elastic.co/t/migrate-elasticsearch-data/306291 "2022-06-03T07:04:56Z")
Hello Elastic Team, I've migrate elastic data from old elastic to new elastic, Data from old index have 90.000.000 Data, but after data migrated, total data in new index just 846.000. Please Help Me, Thankyou --- ## [Logstash won't create new index patterns again](https://discuss.elastic.co/t/logstash-wont-create-new-index-patterns-again/306224)
**Author:** [@Tasdiq\_Shaikh](https://discuss.elastic.co/u/Tasdiq_Shaikh)\ **Replies:** 2\ **Last updated:** [June 3, 2022, 7:00am UTC](https://discuss.elastic.co/t/logstash-wont-create-new-index-patterns-again/306224 "2022-06-03T07:00:07Z")
Previously, I have connected my logstash with PostgreSQL and Elasticsearch and it also created new index pattern, but it wouldnt load data properly so I deleted my index and restarted logstash to create a new index patte… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=914) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=916)