# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=994 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 995 --- ## [Need to set alert which would trigger when API key expires in Elastic stack](https://discuss.elastic.co/t/need-to-set-alert-which-would-trigger-when-api-key-expires-in-elastic-stack/301073)
**Author:** [@sidharth\_vijayakumar](https://discuss.elastic.co/u/sidharth_vijayakumar)\ **Replies:** 0\ **Last updated:** [March 30, 2022, 10:31am UTC](https://discuss.elastic.co/t/need-to-set-alert-which-would-trigger-when-api-key-expires-in-elastic-stack/301073 "2022-03-30T10:31:36Z")
Need to set an alert that would trigger 10days before my API key expiry. So in elastic stack am trying to use API key for authentication in the Kubernetes cluster. The API key needs to have an expiry of 1 year but when i… --- ## [Count status but only for last events](https://discuss.elastic.co/t/count-status-but-only-for-last-events/300104)
**Author:** [@gueri](https://discuss.elastic.co/u/gueri)\ **Replies:** 3\ **Last updated:** [March 30, 2022, 10:24am UTC](https://discuss.elastic.co/t/count-status-but-only-for-last-events/300104 "2022-03-30T10:24:14Z")
Hello, I come here to ask you for help. Thank you in advance to those who will answer me :slight\_smile: I have a index with processing status by city. Status are : UP -\> DEGRADED -\> DOWN Here is an example of a collec… --- ## [Does initial interval work on start up for google workspace module?](https://discuss.elastic.co/t/does-initial-interval-work-on-start-up-for-google-workspace-module/300701)
**Author:** [@YuWatanabe](https://discuss.elastic.co/u/YuWatanabe)\ **Replies:** 2\ **Last updated:** [March 30, 2022, 10:11am UTC](https://discuss.elastic.co/t/does-initial-interval-work-on-start-up-for-google-workspace-module/300701 "2022-03-30T10:11:06Z")
Hello. I would like to ask question for google workspace module . Doc says , filebeat will poll up to var.initial\_interval when the filebeat starts. It will poll events up to this time period when the module starts. … --- ## [Elasticsearch crashes after a few minutes on VM](https://discuss.elastic.co/t/elasticsearch-crashes-after-a-few-minutes-on-vm/300487)
**Author:** [@fidegnon](https://discuss.elastic.co/u/fidegnon)\ **Replies:** 10\ **Last updated:** [March 30, 2022, 9:31am UTC](https://discuss.elastic.co/t/elasticsearch-crashes-after-a-few-minutes-on-vm/300487 "2022-03-30T09:31:50Z")
I have two identical VM where ELK 6.6.2 is running, they are independent and not configured as a cluster. On one Elasticsearch is running fine, on the other Elasticsearch crashes a few minutes after starting. Here is t… --- ## [Kibana server is not ready yet](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/301065)
**Author:** [@Mayuresh\_More](https://discuss.elastic.co/u/Mayuresh_More)\ **Replies:** 0\ **Last updated:** [March 30, 2022, 9:30am UTC](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/301065 "2022-03-30T09:30:41Z")
Hi, I have installed the latest version of all Elasticsearch & Kibana I am able to connect elastic URL but unable to see dashboard (PFA) and give the error "Kibana server is not ready yet." in the browser. 1:) How C… --- ## [Using an element of an array as match\_field in enrich policy](https://discuss.elastic.co/t/using-an-element-of-an-array-as-match-field-in-enrich-policy/301059)
**Author:** [@mustafa\_savran](https://discuss.elastic.co/u/mustafa_savran)\ **Replies:** 0\ **Last updated:** [March 30, 2022, 8:56am UTC](https://discuss.elastic.co/t/using-an-element-of-an-array-as-match-field-in-enrich-policy/301059 "2022-03-30T08:56:40Z")
I have been trying to use the element of an array as match\_field in enrich policy but I didn't achieve this. I have an array contains a bbox, a multi polygon and geo point respectively and I mapped this array as geo\_sh… --- ## [Connection errors during indexing using goroutines](https://discuss.elastic.co/t/connection-errors-during-indexing-using-goroutines/301040)
**Author:** [@apo\_p9](https://discuss.elastic.co/u/apo_p9)\ **Replies:** 4\ **Last updated:** [March 30, 2022, 8:52am UTC](https://discuss.elastic.co/t/connection-errors-during-indexing-using-goroutines/301040 "2022-03-30T08:52:28Z")
I have a syncing utility in Go, that moves data from MongoDB to ES. Here is the gist of it. Create workgroup, launch a goroutine listening on a channel, pull results from Mongo and publish to a channel which will index i… --- ## [Logstash pipelines reduces the number of events sent](https://discuss.elastic.co/t/logstash-pipelines-reduces-the-number-of-events-sent/300000)
**Author:** [@zpltn](https://discuss.elastic.co/u/zpltn)\ **Replies:** 1\ **Last updated:** [March 30, 2022, 8:22am UTC](https://discuss.elastic.co/t/logstash-pipelines-reduces-the-number-of-events-sent/300000 "2022-03-30T08:22:28Z")
Hi there, we have Metricbeat, Filebeat, Logstash and Elasticsearch running on an OpenShift Cluster. We are using Logstash to configure multiples pipelines to filter the logs for some namespaces and Beats types. Our sta… --- ## [Advanced Watcher - If Failed % is greater than some defined threshold value](https://discuss.elastic.co/t/advanced-watcher-if-failed-is-greater-than-some-defined-threshold-value/300727)
**Author:** [@Freddy.Raj](https://discuss.elastic.co/u/Freddy.Raj)\ **Replies:** 6\ **Last updated:** [March 30, 2022, 8:18am UTC](https://discuss.elastic.co/t/advanced-watcher-if-failed-is-greater-than-some-defined-threshold-value/300727 "2022-03-30T08:18:26Z")
Hi All, I need some help to achieve below monitoring condition to enable watcher alert. We have a domain named "XYZ" as a value to one of the term field - "main.domain" Under this domain "XYZ", we see logs for several… --- ## [Kibana drill down fields](https://discuss.elastic.co/t/kibana-drill-down-fields/300970)
**Author:** [@bianca6](https://discuss.elastic.co/u/bianca6)\ **Replies:** 5\ **Last updated:** [March 30, 2022, 8:09am UTC](https://discuss.elastic.co/t/kibana-drill-down-fields/300970 "2022-03-30T08:09:11Z")
Hi, I have some logs like this: country = France, city = Paris, value = 6 country = France, city = Marseille, value = 2 country = Italy, city = Roma, value = 8 In a Kibana dashboards, I can display the countries and s… --- ## [Not getting perfect results (Am using elasticsearch dsl for django ) and please help me](https://discuss.elastic.co/t/not-getting-perfect-results-am-using-elasticsearch-dsl-for-django-and-please-help-me/300994)
**Author:** [@RohitBR\_K](https://discuss.elastic.co/u/RohitBR_K)\ **Replies:** 1\ **Last updated:** [March 30, 2022, 7:57am UTC](https://discuss.elastic.co/t/not-getting-perfect-results-am-using-elasticsearch-dsl-for-django-and-please-help-me/300994 "2022-03-30T07:57:31Z")
Here am searching for juices and am getting the juice products but also am getting other products that includes letter j ,u, i, c, e. Here i used nGram with match query and i used min diff =1 and max diff = 20. kindly pl… --- ## [Elaticsearch Java client output dsl](https://discuss.elastic.co/t/elaticsearch-java-client-output-dsl/300952)
**Author:** [@supermario](https://discuss.elastic.co/u/supermario)\ **Replies:** 12\ **Last updated:** [March 30, 2022, 7:52am UTC](https://discuss.elastic.co/t/elaticsearch-java-client-output-dsl/300952 "2022-03-30T07:52:49Z")
I am using Elasticsearch java Client version 8.1. I want to output dsl by searchrequest, but i don't find any function. I look forward hearing your reply,thanks. --- ## [Watcher cannot be started after upgrading Elasticsearch 7.x to Elasticsearch 8.x](https://discuss.elastic.co/t/watcher-cannot-be-started-after-upgrading-elasticsearch-7-x-to-elasticsearch-8-x/301041)
**Author:** [@yohanwongso](https://discuss.elastic.co/u/yohanwongso)\ **Replies:** 1\ **Last updated:** [March 30, 2022, 7:52am UTC](https://discuss.elastic.co/t/watcher-cannot-be-started-after-upgrading-elasticsearch-7-x-to-elasticsearch-8-x/301041 "2022-03-30T07:52:27Z")
The watcher is stop working just after the Elasticsearch has been upgraded to version 8.x. At the Kibana's Stack Management -\> Watcher, the state of all active watchers are OK, but the watchers haven't been triggered ev… --- ## [Kibana Sharepoint Connector | ingest pipeline question](https://discuss.elastic.co/t/kibana-sharepoint-connector-ingest-pipeline-question/301046)
**Author:** [@msanz-acclaro](https://discuss.elastic.co/u/msanz-acclaro)\ **Replies:** 0\ **Last updated:** [March 30, 2022, 7:40am UTC](https://discuss.elastic.co/t/kibana-sharepoint-connector-ingest-pipeline-question/301046 "2022-03-30T07:40:28Z")
Hi everyone, I am implementing the ELK stack in our company, which so far has gone pretty well. I have a question regarding the Sharepoint connector, I read the doc but have not found (googling) anyone with a similar u… --- ## [Not able to start elasticsearch-2.0](https://discuss.elastic.co/t/not-able-to-start-elasticsearch-2-0/300339)
**Author:** [@siddarthhegde](https://discuss.elastic.co/u/siddarthhegde)\ **Replies:** 2\ **Last updated:** [March 30, 2022, 7:24am UTC](https://discuss.elastic.co/t/not-able-to-start-elasticsearch-2-0/300339 "2022-03-30T07:24:17Z")
Elasticsearch version 2.0 OS: Linux I am not able to start Elasticsearch and I am getting the following error: \[ERROR\]\[gateway \] \[Node\] failed to read local state, exiting... ElasticsearchException\[mu… --- ## [Use ^ for absolute input paths?](https://discuss.elastic.co/t/use-for-absolute-input-paths/301034)
**Author:** [@anon90868141](https://discuss.elastic.co/u/anon90868141)\ **Replies:** 0\ **Last updated:** [March 30, 2022, 6:53am UTC](https://discuss.elastic.co/t/use-for-absolute-input-paths/301034 "2022-03-30T06:53:54Z")
Hello, I recently read about the filebeat filestream input. On prospector.scanner.include\_files, there is an example saying you should use ^ in patterns if they're an absolute path. Does this transfer to the input paths… --- ## [Am I losing data?](https://discuss.elastic.co/t/am-i-losing-data/300819)
**Author:** [@anon90868141](https://discuss.elastic.co/u/anon90868141)\ **Replies:** 4\ **Last updated:** [March 30, 2022, 6:48am UTC](https://discuss.elastic.co/t/am-i-losing-data/300819 "2022-03-30T06:48:54Z")
Hi guys, I'm currently not sure if I'm losing data. Last monday, I restarted the Elasticsearch cluster. Sadly, I restarted the master nodes all at the same time and didn't deactivate the shard allocation. I changed the… --- ## [How filter range date in CreateDate](https://discuss.elastic.co/t/how-filter-range-date-in-createdate/300844)
**Author:** [@Damas\_Mahardi](https://discuss.elastic.co/u/Damas_Mahardi)\ **Replies:** 3\ **Last updated:** [March 30, 2022, 6:48am UTC](https://discuss.elastic.co/t/how-filter-range-date-in-createdate/300844 "2022-03-30T06:48:06Z")
--- ## [Elasticsearch filter plugin "hosts" does not fail over](https://discuss.elastic.co/t/elasticsearch-filter-plugin-hosts-does-not-fail-over/299048)
**Author:** [@Zhang\_Jun\_Wu](https://discuss.elastic.co/u/Zhang_Jun_Wu)\ **Replies:** 1\ **Last updated:** [March 30, 2022, 6:37am UTC](https://discuss.elastic.co/t/elasticsearch-filter-plugin-hosts-does-not-fail-over/299048 "2022-03-30T06:37:53Z")
Hi, I am trying logstash 7.17.1 with a two-node es cluster (es 7.17.0), which are running on localhost:9200 and localhost:9201. Both logstash and Elasticsearch are running on same windows machine. I have written a simpl… --- ## [Elastcsearch client - javascript connection error](https://discuss.elastic.co/t/elastcsearch-client-javascript-connection-error/300894)
**Author:** [@VV1002](https://discuss.elastic.co/u/VV1002)\ **Replies:** 7\ **Last updated:** [March 30, 2022, 5:56am UTC](https://discuss.elastic.co/t/elastcsearch-client-javascript-connection-error/300894 "2022-03-30T05:56:11Z")
Hi, I am running a 7.17 Elasticsearch and kibana services using docker compose with xpack security disabled (local env). I am developing an express application for some data manipulation so trying to use the Elasticsear… --- ## [How to create rule when monitor is up in UPTIME?](https://discuss.elastic.co/t/how-to-create-rule-when-monitor-is-up-in-uptime/300940)
**Author:** [@shivendra95](https://discuss.elastic.co/u/shivendra95)\ **Replies:** 2\ **Last updated:** [March 30, 2022, 5:24am UTC](https://discuss.elastic.co/t/how-to-create-rule-when-monitor-is-up-in-uptime/300940 "2022-03-30T05:24:46Z")
I was exploring the alerting capabilities in ELK, found a way to trigger alerts when any monitor is down in Uptime App. I also want to trigger alerts when the downed service has come back up again but I'm not able creat… --- ## [Help me, question! java.io.IOException: Unable to parse response body for Response{requestLine=PUT](https://discuss.elastic.co/t/help-me-question-java-io-ioexception-unable-to-parse-response-body-for-response-requestline-put/301028)
**Author:** [@wonderfulLand](https://discuss.elastic.co/u/wonderfulLand)\ **Replies:** 0\ **Last updated:** [March 30, 2022, 5:21am UTC](https://discuss.elastic.co/t/help-me-question-java-io-ioexception-unable-to-parse-response-body-for-response-requestline-put/301028 "2022-03-30T05:21:55Z")
Elasticsearch vesion :8.1.0 pom file: \ 4.0.0 org.springframework.boot spring-boot-starter-parent 2.6.4 com.example elasticsearchdemo 0.0.1-SNAPSHOT elasticsearchdem… --- ## [How to map timestamp with nano seconds?](https://discuss.elastic.co/t/how-to-map-timestamp-with-nano-seconds/300881)
**Author:** [@Anusha\_Kusanghi](https://discuss.elastic.co/u/Anusha_Kusanghi)\ **Replies:** 4\ **Last updated:** [March 30, 2022, 5:06am UTC](https://discuss.elastic.co/t/how-to-map-timestamp-with-nano-seconds/300881 "2022-03-30T05:06:42Z")
Hie , I have a time where it is of the format : 2022- 03-28T16:51:11.637003013Z I tried to map like this : date{ match =\> \["Pretime","yyyy-MM-dd'T'HH:mm:ss.SSSSSSSSSZ"\] target =\> "@timestamp" remove\_field =\> "Preti… --- ## [Help me! search rate spike down](https://discuss.elastic.co/t/help-me-search-rate-spike-down/301023)
**Author:** [@slowup](https://discuss.elastic.co/u/slowup)\ **Replies:** 0\ **Last updated:** [March 30, 2022, 4:06am UTC](https://discuss.elastic.co/t/help-me-search-rate-spike-down/301023 "2022-03-30T04:06:34Z")
Hi! Nice to meet you all I'm having a problem with lag issues due to a sharp drop in search rate In other words, the APIs that request a search to elasticseach are experiencing a timeout. I think the image below will e… --- ## [Newcomer multiline.pattern question](https://discuss.elastic.co/t/newcomer-multiline-pattern-question/300934)
**Author:** [@covfefe](https://discuss.elastic.co/u/covfefe)\ **Replies:** 3\ **Last updated:** [March 30, 2022, 2:33am UTC](https://discuss.elastic.co/t/newcomer-multiline-pattern-question/300934 "2022-03-30T02:33:36Z")
Hi, new to filebeat and multiline.pattern configuration as a whole. I was reading up on multiline.pattern examples and came across this where the example used was multiline.pattern: '\[1\]'. But lets say if each line … --- ## [ES not search with hyphen](https://discuss.elastic.co/t/es-not-search-with-hyphen/300769)
**Author:** [@EnJay](https://discuss.elastic.co/u/EnJay)\ **Replies:** 8\ **Last updated:** [March 30, 2022, 12:54am UTC](https://discuss.elastic.co/t/es-not-search-with-hyphen/300769 "2022-03-30T00:54:42Z")
Hello :slight\_smile: I can't figure out the problem at all. I have a field with a title. The name consists of a hyphen. This is: "usd-coin". I'm trying to search with this query: { "sort": \[ { "… --- ## [Would it be deleted the closed index in delete phase of ILM?](https://discuss.elastic.co/t/would-it-be-deleted-the-closed-index-in-delete-phase-of-ilm/300912)
**Author:** [@m-amano](https://discuss.elastic.co/u/m-amano)\ **Replies:** 2\ **Last updated:** [March 30, 2022, 12:22am UTC](https://discuss.elastic.co/t/would-it-be-deleted-the-closed-index-in-delete-phase-of-ilm/300912 "2022-03-30T00:22:35Z")
Does ILM support the closed index to be deleted in delete phase? Or should I reopen the index? --- ## [Officially recommended cluster planning](https://discuss.elastic.co/t/officially-recommended-cluster-planning/300539)
**Author:** [@casterQ](https://discuss.elastic.co/u/casterQ)\ **Replies:** 1\ **Last updated:** [March 29, 2022, 10:38pm UTC](https://discuss.elastic.co/t/officially-recommended-cluster-planning/300539 "2022-03-29T22:38:30Z")
Are there any suggestions for cluster planning and hardware resources： Recommended configuration of CPU？ If there are only a few servers, do you need independent master and coordinating nodes？or reuse server for multip… --- ## [Return other fields in highlight](https://discuss.elastic.co/t/return-other-fields-in-highlight/300898)
**Author:** [@matty\_r](https://discuss.elastic.co/u/matty_r)\ **Replies:** 3\ **Last updated:** [March 29, 2022, 10:28pm UTC](https://discuss.elastic.co/t/return-other-fields-in-highlight/300898 "2022-03-29T22:28:07Z")
Hi all, When highlighting a field, i'd like to also return both fields that are associated. I have the setup below. I want to highlight comment.message, but return both comment.message and comment.id: PUT temp-test { … --- ## [Metricbeat giving start\_time wrong](https://discuss.elastic.co/t/metricbeat-giving-start-time-wrong/301011)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 0\ **Last updated:** [March 29, 2022, 10:04pm UTC](https://discuss.elastic.co/t/metricbeat-giving-start-time-wrong/301011 "2022-03-29T22:04:04Z")
I have version 7.12.0 and some process is giving me wrong start time. here is example and I can only track it down when it is running h101024:/proc/3333% cat stat 3333 (adb9-ompi) S 3329 3333 2764 0 -1 1073741824 1033… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=993) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=995)